The ColorFolio theme for WordPress suffers from a deserialization of untrusted data flaw that enables PHP Object Injection. An attacker can supply crafted serialized data that is processed by the theme, potentially causing arbitrary code execution or other malicious actions on the server. This weakness is a classic instance of insecure deserialization, classified as CWE-502. The vulnerability permits an attacker to inject arbitrary objects into the PHP runtime environment, potentially leading to critical compromise of the affected website.

The flaw is present in all released versions of the ColorFolio theme up to and including version 1.3, provided by BuddhaThemes. Users who are running any of those releases on a WordPress installation are affected. No other vendors or products are listed as impacted.

The CVSS score is 8.8, indicating a high severity risk. The EPSS score is not available, but the absence of a KEV listing does not preclude exploitation; attackers with knowledge of the theme can craft exploits. Based on the description, the likely attack vector is via crafted HTTP requests that deliver serialized payloads to the theme’s processing routines, which may be accessible through theme templates or admin interfaces. The high severity score, coupled with the potential for remote code execution, creates a substantial threat if the environment is exposed to the internet.