This vulnerability permits the deserialization of untrusted data within the BoldThemes Celeste WordPress theme, allowing PHP object injection. The flaw can enable an attacker to inject malicious objects that are processed by PHP’s unserialize function, potentially leading to arbitrary code execution or unauthorized actions within the WordPress site. The weakness corresponds to CWE‑502, which focuses on unsafe deserialization.

The affected product is the BoldThemes Celeste WordPress theme, versions from the earliest release through 1.3.6. Users running these versions are directly exposed until they upgrade or remove the theme.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog. However, the attack vector is likely remote, as attackers can supply crafted data via web requests or uploads to trigger deserialization. Successful exploitation can lead to full control of the hosting environment, compromising site integrity, confidentiality, and availability.