The vulnerability is an unauthenticated PHP Object Injection that exists in all Stargaze WordPress theme releases version 1.10 and earlier. The flaw permits an attacker to submit serialized data that the theme processes without validating the payload, thereby introducing arbitrary PHP objects into the application. This can lead to unexpected behavior of the theme’s code and potentially compromise the integrity or availability of the website.

The Stargaze WordPress theme developed by ThemeREX is affected. All installations using theme version 1.10 or earlier are vulnerable. Versions above 1.10 contain the fix and are not impacted.

The CVSS score of 9.8 indicates a critical vulnerability with high potential impact. No EPSS score is available and the flaw is not listed in CISA’s KEV catalog. The vulnerability description states that unauthenticated users can submit serialized data that the theme processes without validation. It is inferred that this flaw could be triggered remotely by sending crafted requests to vulnerable endpoints, although the description does not explicitly detail the attack vector. If an unpatched theme remains in use, the risk of exploitation is significant. The severity warrants immediate action.