The Archicon WordPress theme contains a deserialization flaw that accepts untrusted data and creates PHP objects from it, leading to arbitrary object injection as defined by CWE‑502. This weakness allows an attacker to introduce unintended objects into the application, potentially altering state or facilitating further exploitation; however, the official description does not confirm that it enables remote code execution.

All installations of the Edge‑Themes Archicon theme with a version earlier than 1.7 are affected, regardless of any sub‑version designation. Both fresh WordPress deployments and existing sites that have not updated the theme are vulnerable.

The CVSS score of 5.4 indicates a moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. An attacker is likely to exploit this flaw by supplying crafted serialized input to a function provided by the theme, possibly through form submissions, URL parameters, or other user‑supplied data. If successful, the injected objects could alter application behavior or interact with other components, representing a significant risk to confidentiality and integrity.