The Gracey theme for WordPress contains a deserialization flaw that permits an attacker to inject an arbitrary PHP object by submitting crafted serialized data. This object injection can be used to instantiate objects with unintended parameters, leading to potential execution of malicious code on the web server. The flaw is identified as a deserialization of untrusted data weakness (CWE‑502).

Vulnerable installations are those running the Edge‑Themes Gracey theme in any released version prior to 1.4. The affected range is unspecified beyond the upper bound of <1.4, meaning all earlier versions are susceptible. No specific revision numbers are provided, so users should consider any prior release insecure.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1 %, suggesting a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, relying on the public WordPress site; an attacker would need to supply malformed serialized input to the theme’s deserialization logic. Based on the description, it is inferred that successful exploitation requires carefully crafted payloads and bypassing input validation, but it could ultimately lead to remote code execution on the server.