Deserialization of untrusted data in the Aperitif theme allows malicious actors to inject crafted PHP object instances, potentially enabling remote code execution or other severe actions against the affected WordPress site. The vulnerability employs the Object Injection weakness (CWE-502) and can be triggered when an attacker supplies serialized input that the theme processes without proper validation. The effect of a successful exploitation would likely be full compromise of the web application, including data disclosure, modification, or defacement.

The vulnerability impacts the WordPress Aperitif theme from Elated‑Themes, through all versions up to and including 1.6. No specific sub‑versions within that range are excluded; users on 1.5.x or earlier are also affected.

The CVSS score of 8.1 indicates a high severity. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploitation yet. Nevertheless, the availability of the vulnerability and its high potential impact make timely mitigation critical. Attackers can exploit the weakness by submitting serialized data via the theme’s data handling processes, which, if unfiltered, may lead to code execution or other malicious actions.