The Stål WordPress theme contains an insecure deserialization flaw that permits attackers to instantiate arbitrary objects. The vulnerability is classified as CWE‑502. This flaw can potentially be leveraged to execute unauthorized code or alter the application’s behavior, depending on how the deserialized data is used within the application.

The issue affects the Mikado‑Themes Stål WordPress theme across all versions older than 1.7. In particular, any installation running a version earlier than 1.7 is vulnerable.

The CVSS score of 5.4 indicates a moderate severity, and the lack of an EPSS score or KEV listing suggests that exploitation is not widely documented at present. Based on the description, the likely attack vector is remote, requiring the attacker to supply malicious serialized data—such as through a form submission or other user input—to trigger the deserialization process. Because no official patch is listed in the provided references, the risk remains until the theme is updated to a fixed version.