The vulnerability is a flaw in deserialization of untrusted data that permits attackers to perform PHP object injection in the ThemeREX Organic Beauty WordPress theme. This weakness can let an attacker supply crafted serialized objects that the theme processes without adequate validation, resulting in the execution of arbitrary PHP code. The primary impact is the potential for attackers to gain full system compromise, with unrestricted confidentiality, integrity, and availability damage.

WordPress sites that use the ThemeREX Organic Beauty theme in any version up to and including 1.4.6 are affected. This includes all WordPress installations that have installed the theme directly from the ThemeREX repository or theme marketplace.

The CVSS score of 9.8 indicates a critical risk level and the EPSS score of less than 1% suggests that exploitation is not yet widespread but remains possible. Because the vulnerability involves PHP object injection through deserialization of untrusted user data, the likely attack vector is remotely crafted HTTP requests directed at the theme’s processing endpoints. No known exploit has been listed in the KEV catalog, but the severity warrants prompt attention.