Deserialization of untrusted data in the Dentario theme allows PHP object injection, a form of insecure deserialization that can enable remote code execution and full compromise of the affected WordPress site. The vulnerability is identified as CWE‑502 and satisfies the criteria for critical severity due to the ability to execute arbitrary code on the web server with the privileges of the web application. Exploiting this flaw would grant attackers control over the file system, database, and WordPress installation, potentially facilitating credential theft, defacement, or serving malware to site visitors.

All WordPress installations that have the ThemeREX Dentario theme version 1.5 or earlier. The issue applies across every variant of the theme used in the public or private sites that have not applied the update past version 1.5.

The CVSS score of 9.8 marks this vulnerability as critical, and although the EPSS score is below 1 %—indicating a low probability of mass exploitation—it remains a high‑risk target for determined adversaries. The attack vector can be inferred as a remote request that triggers the theme’s deserialization logic, such as a crafted POST or GET payload to an admin or AJAX endpoint. Since the vulnerability is not listed in the CISA KEV catalog, there is currently no confirmed exploitation activity, but the potential for undisclosed or future attacks exists.