An unserialize attack would require intimate knowledge of the operating codebase, as well as an encoded object (only objects can be exploited this way) that cou

An unserialize attack would require intimate knowledge of the operating codebase, as well as an encoded object (only objects can be exploited this way) that could be configured to execute an attack via its constructor or __set_state() method. Or, installing a backdoor through another CVE to create the opportunity for just this kind of attack. It's complex, but not unknown. I'm not aware of any major applications (WordPress, Drupal, etc) that deserialize user input. That's not to say a plugin or theme might be unsafe, but not in the core code that I've seen.