A deserialization flaw in the axiomthemes 777 triple-seven WordPress theme up to version 1.13.0 allows an attacker to inject a crafted object into PHP’s unserialize routine, classified as CWE-502. Exploiting this can give the attacker arbitrary code execution on the affected WordPress site by delivering unsanitized serialized data that the theme processes without validation.

The 777 theme sold by axiomthemes is affected when installed in WordPress. The vulnerability exists in all releases up to and including version 1.13.0 and does not affect any other product or vendor.

The CVSS score of 9.8 indicates a critical level of risk, while the EPSS score of less than 1% suggests that exploitation in the wild is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote injection of serialized data via a crafted request to the theme, such as a form submission or a query parameter that the theme processes without filtering. Successful exploitation would allow the attacker to execute arbitrary code on the compromised WordPress installation.