The vulnerability is a deserialization of untrusted data flaw that allows PHP object injection in the ThemeREX Buisson theme. If an attacker supplies crafted input during rendering or configuration, the theme may unserialize data that triggers arbitrary PHP code execution. Based on the description, it is inferred that exploitation could lead to remote code execution, allowing full compromise of the WordPress site.

The issue affects ThemeREX Buisson installations running any released version up to and including 1.1.11 on WordPress sites. Sites that have not upgraded beyond that version are susceptible. No other vendors or products are listed.

The vulnerability has a CVSS base score of 9.8, indicating critical severity, while the EPSS score is below 1%, suggesting a low current exploitation chance. It is not listed in the CISA KEV catalog. The likely attack vector is through crafted HTTP requests or form submissions that trigger the theme’s deserialization routine; based on the description, it is inferred that successful exploitation would provide remote code execution or equivalent access. Administrators should treat this as a high‑priority issue.