Unauthenticated PHP Object Injection exists in WordPress Splendour theme versions 1.23 and earlier, allowing an attacker to craft a serialized PHP payload that is unserialized by the theme code. This flaw is classified as CWE‑502 and can lead directly to arbitrary code execution and full compromise of the web server if the attacker is able to deliver the payload through a publicly accessible request. The exploit can read or modify any file on the server, install back‑doors, or move laterally within the host environment.

The vulnerability affects installations of the Splendour theme produced by ThemeREX, any WordPress site running a theme version up to and including 1.23. No other WordPress components are listed as affected by this CVE.

The CVSS score of 9.8 marks this as a critical risk. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, but because the object injection is unauthenticated, any user who can access the WordPress site can potentially trigger the flaw. The likely attack vector involves sending a crafted HTTP request that triggers the theme’s unserialize operation; the attacker must have network access to the web server but does not need administrative credentials. Given the high severity and broad impact, exploitation is considered feasible and potentially valuable for attackers.