The vulnerability is a deserialization of untrusted data flaw that allows attackers to perform object injection. This flaw is classified as CWE‑502 and can result in remote code execution, compromising the confidentiality, integrity, and availability of the affected site. The main risk is that an attacker can craft malicious serialized objects that the theme will unserialize and execute, potentially giving full control over the web application.

The defect applies to the WordPress ThemeREX Sound | Musical Instruments Online Store theme at versions 1.6.9 and earlier. Sites that use this theme, whether installed on WordPress 5.x or newer, are affected until the theme is updated beyond that release.

The CVSS score of 9.8 indicates critical severity; the EPSS score of less than 1 % suggests a low probability of exploitation, but the lack of a KEV listing does not diminish the importance of remediation. Attackers likely would exploit the flaw by sending a crafted serialized payload to an endpoint or component of the theme that performs unserialization, either via authenticated or unauthenticated requests. The exact attack vector is not disclosed, so defensive measures should assume both scenarios.