WordPress sites that use the Asia Garden theme version 1.3.1 or older are vulnerable to unauthenticated PHP Object Injection. The encoder flaw allows an attacker to craft a payload that is unserialized by the theme’s code, which can lead to arbitrary PHP code execution or disclosure of confidential information. This weakness is classified as CWE‑502, indicating that the application fails to properly validate serialized data before its use.

The affected product is the Asia Garden theme from ThemeREX. All installations of the theme with a version of 1.3.1 or earlier are impacted. Sites that depend on this theme for template rendering or other functionality fall under the same risk scope.

The CVSS score of 9.8 places this flaw in the Critical category, reflecting a high likelihood of severe impact. While the EPSS score is not available, the lack of a KEV listing does not diminish the risk. The vulnerability is unauthenticated, meaning an attacker can exploit it from any external source that can send a crafted request to the website. This could result in full code execution, database compromise, or site defacement.