The vulnerability is a deserialization of untrusted data that permits PHP object injection in the Edge‑Themes Pelicula WordPress theme. An attacker who supplies crafted data to the theme’s deserialization routine can instantiate arbitrary PHP objects, which may lead to remote code execution, unauthorized data modification, or full compromise of the WordPress site. The weakness corresponds to CWE‑502 and carries a CVSS score of 9.8, indicating a critical impact on confidentiality, integrity, and availability.

The issue affects the Edge‑Themes Pelicula theme for WordPress. All released versions prior to 1.10 are vulnerable, including the very first release of the theme. Site owners who have installed any of those builds are at risk unless they upgrade to version 1.10 or newer.

The CVSS score of 9.8 signals a high technical risk, yet the EPSS score is below 1%, suggesting a low likelihood of active exploitation today. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a malicious serialized payload that is processed by the theme’s deserialization routine. While the specific trigger is not detailed in the advisory, it is inferred that the vector could involve crafted HTTP requests or POST bodies targeting the theme’s input handlers. Successful exploitation could grant an attacker full control over the affected WordPress installation.