The Blocksy theme for WordPress allows an attacker with contributor level or higher to submit a serialized PHP object through the 'blocksy_meta' REST API field. Because the input sanitization routine only removes '<' and '>' characters, serialized object strings are stored without restriction. During the V200 database migration, all string values are unserialized unconditionally, enabling the injected <Blocksy\RaiiPattern> object to call its __destruct() method, which then executes arbitrary callables via call_user_func(). This flaw can be leveraged to run arbitrary PHP code on the host, leading to full remote compromise of the affected WordPress installation.

Versions of the Blocksy theme up to and including 2.1.35, developed by creativethemeshq, are vulnerable. The weakness resides in the handling of the 'blocksy_meta' REST API field and the database migration logic that processes post meta entries.

The CVSS score of 8.8 signals high severity. While EPSS data is not available and the flaw is not listed in the CISA KEV catalog, the risk remains significant due to the authentication requirement: an attacker must obtain or compromise a contributor‑level account. Once authenticated, they can inject the malicious serialized object and trigger the deserialization chain, resulting in remote code execution.