The vulnerability is an unauthenticated PHP Object Injection in the BoldThemes Avala theme that occurs when the theme unserializes untrusted data. An attacker who can send a crafted serialized payload can execute arbitrary PHP code, fully compromising the affected WordPress site. The flaw maps to CWE‑502, which describes object injection via PHP’s unserialize routine.

WordPress installations that use the BoldThemes Avala theme version 1.1.4 or earlier are vulnerable. Any site that has not upgraded beyond 1.1.4 and still hosts the theme is at risk.

The CVSS score of 9.8 indicates critical severity, and although EPSS is unavailable, PHP object injection is a known high‑risk technique when untrusted input is unserialized. The vulnerability is not listed in the CISA KEV catalog, but that does not reduce the potential for exploitation. Likely attackers would target a WordPress endpoint that accepts theme options or plugin data, injecting a malicious serialized object to gain remote code execution without authentication.