The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in Themeton Finag theme. This weakness (CWE-502) allows a malicious actor to craft input that results in the creation of objects with arbitrary properties, potentially leading to remote code execution or other severe compromise of the site’s integrity, confidentiality, and availability.

WordPress installations employing the Themeton Finag theme up to and including version 1.5.0 are impacted. The vulnerability applies to all releases from the initial release through 1.5.0, with no newer version mentioned as a safe fix.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of < 1% indicates a very low probability of exploitation, but the lack of a KEV listing does not reduce the urgency; the high severity and potential remote exploitation suggest that attackers could exploit this without advanced preparation. The likely attack vector is through input that the theme deserializes without adequate validation, which could be supplied via crafted URLs, form submissions, or other mechanisms that reach the theme’s code.