Subscriber PHP Object Injection allows an attacker to insert a crafted serialized object into the RealHomes theme when a user subscribes, potentially causing the application to unserialize the payload and execute malicious code. This vulnerability falls under CWE-502, the deserialization of untrusted data, and can lead to remote code execution or privilege escalation within the WordPress installation. The impact is severe, as the attacker could gain full control over the compromised site.

The RealHomes theme version 4.5.3 and earlier from InspiryThemes is affected. Users running these older theme releases on WordPress should verify their version and upgrade when possible.

The CVSS score of 8.8 indicates high severity, and because the EPSS score is not available, the exploitation probability remains uncertain, but the vulnerability is not yet listed in the C The likely attack vector involves sending a crafted serialized payload through a subscription endpoint, such as the contact form or user registration, which triggers the. If executed, the attacker can induce arbitrary code execution or modify site content, providing a pathway to compromise the entire WordPress environment.