The CVE involves a deserialization flaw in ThemeREX Kingler that allows an attacker to inject arbitrary PHP objects. This object injection can trigger magic methods during deserialization, potentially enabling the execution of arbitrary code or modification of system state. The weakness is classified as CWE‑502, which highlights the risk of insecure handling of serialized data.

Systems affected are WordPress sites that use the Kingler theme from ThemeREX, versions from the first public release up to and including 1.7. Any site deploying these versions is vulnerable.

The vulnerability has a CVSS score of 9.8, indicating a critical severity. EPSS is reported as less than 1 %, suggesting a very low probability of exploitation in the wild at present. The CVE is not listed in the KEV catalog. The likely attack vector, based on the nature of PHP object deserialization, is via web requests that include serialized data—such as form submissions, admin panel inputs, or crafted URLs. Successful exploitation would allow an attacker to run arbitrary PHP code on the affected WordPress installation.