The vulnerability is a PHP Object Injection that occurs when the Neo | Barber Shop WordPress Theme deserializes data received from an untrusted source. The use of PHP’s unserialize function on data that can be controlled by an external actor is a classic CWE‑502 weakness, enabling an attacker to craft a malicious serialized string that, when processed, instantiates objects that can execute arbitrary PHP code. If successful, this flaw can compromise the confidentiality, integrity, and availability of the affected WordPress site.

All WordPress installations that use BuddhaThemes Neo | Barber Shop WordPress Theme version 3.5 or earlier are affected. Any site running the theme up to and including 3.5, regardless of whether the theme is the active template, is at risk.

With a CVSS score of 8.8, the vulnerability is considered high risk. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the lack of a KEV listing does not mitigate the threat. The attack vector is presumably remote, with an attacker sending a crafted serialized payload via an HTTP request to an endpoint handled by the theme. Successful exploitation would allow arbitrary code execution on the web server, potentially leading to full site compromise.