An issue exists where the XML-RPC client deserializes Java object data received in responses when sending a weblog update ping. An attacker controlling the response can execute arbitrary code within the server process. Deserialization is the process of converting a data format, such as XML, back into an object that can be used by a program.