Deserialization of untrusted data in the ThemeGoods Photography theme allows an attacker to inject a malicious serialized PHP object, which can lead to the execution of arbitrary code on the host. The primary impact is a loss of integrity and confidentiality, as the attacker could gain full control of the WordPress site and potentially all data stored on it. This is a classic PHP Object Injection flaw identified as CWE‑502.

The vulnerability affects the ThemeGoods Photography WordPress theme for all releases up to and including version 7.5.2. Users running any earlier version of the theme on a WordPress installation are exposed to this risk.

The CVSS score of 8.5 signifies a high severity potential. The EPSS score of less than 1% indicates that, as of the latest data, exploitation is not common, yet the category remains high risk because an attacker can target any vulnerable theme through the network. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score warrants immediate attention. The likely attack vector is remote, where an attacker crafts and submits a malicious serialized object to a data processing endpoint within the theme.