The Sweet Date theme for WordPress contains a deserialization of untrusted data flaw that allows attackers to inject arbitrary PHP objects. This vulnerability corresponds to CWE‑502 and can lead to remote code execution (inferred from the nature of PHP object injection), enabling attackers to compromise the confidentiality, integrity, and availability of the affected website.

Any WordPress installation that uses the SeventhQueen Sweet Date theme with a version earlier than 4.0.1, spanning from the theme’s initial release through the last patched (4.0.1).

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% implies a very low current exploitation probability. The likely attack vector is remote (inferred), requiring an attacker to craft a serialized payload and send it via the theme’s web interface or any endpoint that deserializes user input; if the vulnerability is triggered, it is inferred that the attacker could execute arbitrary code on the web server. The issue is not listed in CISA’s KEV catalog, so it has not been confirmed as a known exploited vulnerability yet.