A high-severity PHP object injection vulnerability in the rascals Pendulum theme allows authenticated attackers to potentially execute arbitrary code on the underlying server.

The flaw exists within the theme's handling of user-supplied data, where improper deserialization allows an authenticated attacker to inject malicious PHP objects. This vulnerability stems from CWE-502: Deserialization of Untrusted Data, which can lead to remote code execution or other malicious actions depending on the available gadget chains in the environment.

Successful exploitation of this vulnerability poses a severe risk, as it allows an attacker to manipulate server-side processes, potentially leading to a full system compromise. Given the CVSS score of 8.8, this issue is categorized as High severity, threatening data integrity, confidentiality, and the overall availability of the affected WordPress instance.

Immediate Action: As no specific patch version is confirmed, administrators should immediately deactivate or remove the rascals Pendulum theme until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at theme-specific endpoints that appear to contain serialized PHP data structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and suspicious serialized input strings.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the high CVSS score and the critical nature of PHP object injection, immediate action is required to reduce the attack surface. Administrators must prioritize deactivating the vulnerable Pendulum theme and monitor vendor channels closely for an official security release that addresses the deserialization flaw.