The vulnerability is an Object Injection flaw caused by deserialization of untrusted data. Attackers who can supply crafted serialized input can exploit this to execute arbitrary PHP code on the server, potentially granting full control over the WordPress site, its data, and associated infrastructure. The flaw can be leveraged to compromise confidentiality, integrity, and availability of the affected system.

The PIMP - Creative MultiPurpose WordPress theme from themeton is vulnerable in all releases through version 1.7. The exact starting release is unspecified, but the description indicates that the entire range ending at 1.7 is affected. No later versions are listed as vulnerable.

The CVSS score is 9.8, signaling a high severity scenario that can be exploited remotely. The EPSS score is below 1 %, suggesting that actual exploitation is currently rare, and the vulnerability is not listed in CISA KEV catalog. Based on the description, it is inferred that attackers could potentially trigger the flaw from any remote endpoint that accepts serialized data – for example, theme settings, custom post types, or maliciously crafted URLs. While no public exploit is documented, the low EPSS does not negate the high potential impact of a successful exploit.