The vulnerability is a PHP Object Injection flaw caused by deserializing untrusted data in the LoftOcean PatioTime theme. This flaw allows an attacker to inject malicious objects, which can lead to execution of arbitrary code, compromise of the site's integrity and confidentiality, and potentially full server compromise. The weakness is identified as CWE-502, indicating insecure deserialization. The impact could extend across any user who can submit data that is processed by the theme, meaning that a single compromised input could affect the entire WordPress site.

All installations of the LoftOcean PatioTime theme earlier than version 2.1 are affected. The vulnerability statement lists the affected range as "from n/a through < 2.1," meaning that any release before 2.1 may contain the flaw. If the theme is deployed on a WordPress site, that site is at risk until the theme is upgraded or the vulnerable component removed.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits as of the last assessment. However, the likely attack vector is through web requests that are processed by the theme’s deserialization routine, such as form submissions or custom endpoints. Inference of the attack path is based on the nature of PHP object injection, which typically requires an attacker to supply a crafted serialized string to the vulnerable function.