Deserialization of untrusted data within the Lorem Ipsum | Books & Media Store theme allows an attacker to inject PHP objects. This can result in arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected WordPress site. The weakness is identified as CWE-502.

The flaw exists in the ThemeREX Lorem Ipsum | Books & Media Store WordPress theme for all releases through version 1.2.11. Any WordPress installation that has this theme active and has not upgraded beyond 1.2.11 is vulnerable. The vendor is ThemeREX; the product name is Lorem Ipsum | Books & Media Store.

The CVSS score of 9.8 marks it as critical, while the EPSS score of less than 1% indicates a low but nonzero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation in the wild yet. Attackers can likely exploit the issue remotely by submitting crafted data to the theme’s deserialization logic, possibly via form submissions or upload mechanisms. The absence of a public exploit does not mitigate the high-risk nature implied by the CVSS score.