Buzz Stone | Magazine & Viral Blog WordPress Theme versions 1.0.2 and earlier contain an unauthenticated PHP Object Injection flaw (CWE-502). The vulnerability allows an attacker to supply crafted serialized data that is deserialized by the theme, enabling execution of arbitrary PHP code. Successful exploitation can compromise the entire website, allowing full control, data exfiltration, and persistence.

The affected product is the ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme. All installations running version 1.0.2 or earlier are impacted. No other vendors or product lines are affected according to the CNA data.

With a CVSS score of 9.8 the flaw is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is unauthenticated, an attacker can target any WordPress site that uses a vulnerable Buzz Stone installation without needing privileged access. The exploitation path requires only an HTTP request to the theme’s entry point, where the serialized payload is processed.