Deserialization of untrusted data in the Edge‑Themes Kamperen WordPress theme allows an attacker to inject arbitrary PHP objects. This object injection can lead to unauthorized code execution or privilege escalation on the affected site. The weakness is classified as CWE‑502 and grants an attacker a high level of control over the application once exploited.

The Kamperen theme versions earlier than 1.3 are vulnerable. Site owners using any of these versions must consider them at risk until the theme is updated to 1.3 or later.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, further implying limited current exploitation. Exploitation would require an attacker to supply crafted serialized payloads, likely through a remote interface such as a form or plugin data submission.