Deserialization of untrusted data in the ThemeREX Love Story theme allows PHP object injection, a flaw classified as CWE‑502. The injection can enable an attacker who supplies crafted serialized input to instantiate arbitrary PHP objects, potentially leading to remote code execution or other severe consequences depending on the server configuration and plugins in use.

The vulnerability affects the WordPress Love Story theme by ThemeREX, specifically versions from the initial release up through 1.3.12. Any WordPress site running one of these versions is potentially exposed.

The CVSS score of 9.8 indicates critical severity, while the EPSS below 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, via maliciously crafted data sent to the theme’s deserialization logic, such as through form input or URL parameters. Without an available patch or mitigation from the vendor, an attacker could achieve full code execution on the affected server.