The vulnerability is a deserialization of untrusted data flaw in the Elated-Themes Töbel WordPress theme. An attacker can supply a crafted payload that is unserialized by the theme, leading to PHP object injection. This flaw allows the attacker to create arbitrary PHP objects, which can result in the execution of malicious code, complete compromise of site confidentiality, integrity, and availability.

WordPress sites using the Töbel theme with versions up to and including 1.8.1 are affected. Versions 1.9 and later contain the fix. Any site that has not yet upgraded to at least 1.9 remains vulnerable.

With a CVSS score of 8.1 the flaw is considered high severity. The EPSS score is not available, but the lack of a current exploit listing in the CISA KEV catalog suggests it has not yet been widely used in the wild. The attack vector is inferred to be remote, requiring an attacker to supply malicious serialized data to the theme. An attacker could achieve remote code execution by injecting PHP objects that invoke magical methods during unserialization. The vulnerability remains high risk until the theme is updated.