The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data within the Save Life theme. An attacker can supply crafted serialized data that the theme blindly processes, enabling execution of arbitrary PHP code. The weakness is categorized as CWE‑502 and can lead to full compromise of the affected WordPress site, including data theft, defacement, or further lateral movement.

All WordPress installations that use ThemeREX Group:Save Life theme version 1.2.14 or earlier are affected. The issue applies from the theme’s initial release through version 1.2.14.

The CVSS score of 9.8 indicates critical severity. Although the EPSS score is not publicly available, the lack of listing in the CISA KEV catalog does not reduce the risk; the flaw provides an external attacker a reliable path to remote code execution via benign-looking theme functions. An attacker can deliver malicious input through any interface that the theme processes, such as form submissions or custom post fields, and trigger the vulnerable unserialize call. The impact is site‑wide compromise if executed successfully.