A critical deserialization vulnerability in the BoldThemes Codiqa WordPress theme enables unauthenticated attackers to execute arbitrary code on the host server.

The software fails to properly sanitize input before deserialization (CWE-502), allowing an unauthenticated attacker to inject malicious PHP objects to trigger remote code execution.

This vulnerability carries a CVSS score of 9.8, indicating the highest level of risk. An attacker can leverage this flaw to gain full control over the underlying web server, leading to complete data loss, unauthorized access to internal systems, and potential lateral movement within the network.

Immediate Action: Update the BoldThemes Codiqa theme to version 1.2.8 or later immediately.

Proactive Monitoring: Monitor server logs for unexpected process execution or suspicious file modifications often associated with object injection payloads.

Compensating Controls: Use a WAF to inspect and block incoming HTTP requests containing serialized PHP objects or suspicious character sequences.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates an immediate update to version 1.2.8. Security teams must ensure that all instances of the Codiqa theme are patched to prevent total system compromise.