The Borgholm theme for WordPress suffers from a deserialization vulnerability that permits PHP Object Injection. An attacker who can supply crafted serialized data to the theme’s code can instantiate objects of classes controlled by the attacker, potentially leading to arbitrary code execution on the web server. The weakness is a classic untrusted deserialization flaw, identified as CWE‑502.

The vulnerability affects all installs of the WordPress Borgholm marketing‑agency theme running any version prior to 1.6. The theme is distributed by Select‑Themes under the name Borgholm and is used as a WordPress plugin/theme. The specific product is the Borgholm theme, version range n/a through < 1.6.

The CVSS score of 9.8 highlights a critical severity, and the EPSS score of less than 1% suggests that the public exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog, but the potential for remote code execution remains high. From the description, it is inferred that the attack vector is remote via the theme’s handling of user‑supplied data, such as form submissions or URL parameters, that are deserialized without validation.