The vulnerability is a Deserialization of Untrusted Data flaw that allows PHP Object Injection via the Climax Themes Kata Plus WordPress plugin. Attackers who can supply crafted serialized data to the plugin can instantiate arbitrary PHP objects, leading to execution of application logic and, ultimately, Remote Code Execution. This weakness is identified as CWE-502 and compromises both confidentiality and integrity of the affected system.

Climax Themes Kata Plus plugin is affected. Versions from the earliest available release up through 1.5.3 are vulnerable; no earlier safe version is identified in the advisory. Users running any of these versions should consider the plugin as a critical risk.

The CVSS score of 9.8 categorizes this issue as Critical, indicating a high impact if exploited. The EPSS score of less than 1% suggests that the probability of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web requests that reach plugin code handling serialized input; however, the exact entry point is not explicitly detailed in the advisory and is inferred from the nature of PHP object injection flaws.