The vulnerability is a PHP deserialization flaw that allows an attacker to inject arbitrary PHP objects into the ThemeGoods PhotoMe theme. This Object Injection can lead to remote code execution, enabling attackers to compromise the entire WordPress site. The weakness is classified as CWE‑502, deserialization of untrusted data.

WordPress sites using the ThemeGoods PhotoMe theme, versions 5.6.11 and earlier.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is below 1 %, showing that exploitation is currently considered unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to provide crafted serialized data, most likely through a theme setting, REST API, or other input vector that accepts untrusted input. Because the flaw enables arbitrary code execution, a successful exploitation would give the attacker full control of the compromised WordPress installation. However, the low EPSS suggests that, as of now, there is minimal evidence of active exploitation in the wild.