A high-severity deserialization vulnerability in the NooTheme CitiLights theme allows authenticated attackers to execute arbitrary code, posing a significant risk to site integrity and data security.

This vulnerability is a deserialization of untrusted data flaw, categorized as CWE-502, which permits the injection of malicious objects into the application. Based on the CVSS vector (PR:L), this attack requires an authenticated user with at least low-level privileges to trigger the vulnerable function.

The ability to perform object injection often leads to remote code execution, which can result in a total compromise of the affected WordPress site. Given the CVSS score of 8.8, this vulnerability carries a high risk of unauthorized data access, potential exfiltration of sensitive user information, and complete site takeover, which could lead to severe reputational and operational damage.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official NooTheme update channels for a fix and apply it immediately upon release. If an update is not available, consider deactivating the CitiLights theme if it is not essential to business operations.

Proactive Monitoring: Security teams should review server access logs for suspicious POST requests or unusual patterns directed toward the theme directory. Monitor for unauthorized file modifications or unexpected outbound network connections initiated by the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block serialized PHP objects in HTTP requests. This can provide a virtual patch by filtering malicious input before it reaches the vulnerable theme component.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate attention from IT and security teams. Administrators should prioritize the identification of all instances of the NooTheme CitiLights theme within their environment and prepare to apply the vendor-provided update as soon as it becomes available to mitigate the risk of remote code execution.