The vulnerability involves deserialization of untrusted data within the Halstein theme of WordPress, enabling attackers to inject arbitrary PHP objects. This object injection can result in remote code execution, allowing an attacker to run arbitrary code with the permissions of the web server, potentially compromising the entire site.

All releases of the Halstein theme by Mikado‑Themes prior to version 1.8 are affected. Users running any of those earlier versions are exposed to the risk.

The CVSS base score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not included in CISA’s KEV catalog. Exploitation would typically involve supply of crafted serialized data—most likely through user‑submitted forms or data import features—though the exact attack vector is inferred from the nature of the weakness. Administrators should treat the issue as a moderate risk and act promptly to mitigate.