The vulnerability allows attackers to inject arbitrary objects through the deserialization process of untrusted data within the Elated-Themes Leroux theme. This flaw falls under CWE‑502 and provides the potential for an attacker to alter application logic, gain unauthorized access, or execute code by crafting malicious serialized payloads. The impact is limited to the scope of the website that uses the theme and depends on the functions executed during deserialization.

Elated-Themes Leroux theme, versions prior to 1.4. Any WordPress installation that includes this theme and is running a version older than 1.4 is affected.

The CVSS score of 5.4 indicates a medium severity, suggesting significant but not critical risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The attack vector is inferred to be interaction with the theme's deserialization logic—likely via crafted requests or inputs that trigger unserialization. If the theme processes user-supplied data without proper validation, the vulnerability could be exploited by a remote attacker with internet access to the WordPress site.