The Askka WordPress theme up to version 1.3.1 contains a PHP Object Injection flaw that arises when the theme deserializes untrusted serialized data. This weakness allows an attacker to construct malicious serialized payloads that the PHP runtime interprets, potentially leading to arbitrary code execution. The CVE description does not specify the exact outcome of such an exploitation, so the extent of damage is inferred from the typical behavior of PHP object injection and is not guaranteed by the data provided.

The vulnerability affects the Elated‑Themes Askka WordPress theme in all releases through 1.3.1. Any WordPress installation that has this theme active or scheduled to be activated is potentially exposed.

The CVSS base score of 8.1 indicates high severity. An EPSS score has not been published, and the issue is not listed in the CISA KEV catalog. Exploitation would likely require a crafted web request that reaches the theme’s deserialization logic, which is normally available to any visitor of the public WordPress site. Based on common exploitation patterns for PHP object injection, remote code execution could be possible, though the CVE itself does not confirm that outcome.