The issue is a PHP Object Injection vulnerability caused by deserialization of untrusted data in the ThemeREX ZenSoul theme. This flaw permits arbitrary PHP code execution, which can lead to full compromise of the WordPress site, potentially exposing sensitive data, altering or deleting content, and enabling the attacker to maintain persistence on the server.

All installations of ThemeREX ZenSoul for WordPress from the first released version up to and including 1.13 are affected. No specific lower bound version is listed, meaning any version prior to 1.14 carries this risk.

The CVSS score of 9.8 highlights critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting the absence of known public exploits at this time. However, it is inferred that the flaw can be triggered remotely by a crafted request to the site, allowing an attacker to inject serialized objects and execute malicious code.