The Themeton Zuut WordPress theme contains a critical deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

This is a deserialization of untrusted data vulnerability (CWE-502) that allows for PHP object injection. The vulnerability is accessible to unauthenticated remote attackers.

With a CVSS score of 9.8, this vulnerability poses an extreme risk to the availability, integrity, and confidentiality of the affected web application. Successful exploitation could grant an attacker full control over the web server, facilitating data breaches or the deployment of persistent backdoors.

Immediate Action: No patch is currently available; users should immediately deactivate the Zuut theme and transition to a supported alternative to protect the environment.

Proactive Monitoring: Monitor server logs for anomalous PHP activity or payloads containing serialized objects.

Compensating Controls: Utilize a robust WAF to filter out malicious web requests and prevent the delivery of serialized PHP payloads to the application.

Public Exploit Available: Unknown

Given the lack of a vendor patch and the critical nature of unauthenticated remote code execution, immediate removal of the Zuut theme is strongly advised. Organizations must treat this as a high-urgency task to prevent potential compromise of their web infrastructure.