The vulnerability originates from the deserialization of untrusted data in the ThemeGoods Photography WordPress theme, enabling an attacker to perform PHP Object Injection. This weakness, classified as CWE‑502, can allow an attacker to inject malicious objects, potentially leading to arbitrary code execution, data corruption, or denial of service. The description explicitly states that the issue allows Object Injection, implying the consequence is that an attacker could manipulate the system's internal state or execution flow by inserting crafted objects into the deserialization process.

ThemeGoods Photography theme for WordPress, versions n/a through <=7.7.2, making all installations of this theme and WordPress sites using those versions susceptible. The affected product is the Photography theme distributed by ThemeGoods within the WordPress ecosystem.

The CVSS score of 9 indicates a critical severity, and the EPSS score of <1% shows a very low but non-zero likelihood of exploitation at the current time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an unauthenticated request that triggers the theme’s deserialization routine, such as via a crafted URL or form submission. If exploited, an attacker could achieve remote code execution or significant compromise of site integrity and availability.