The flaw is a PHP Object Injection that occurs when the theme deserializes data supplied by an attacker. Because the data is not trusted, it can cause arbitrary objects to be instantiated and subsequently executed, potentially allowing an attacker to run arbitrary code. The vulnerability is classified as CWE-502, reflecting unsafe handling of serialized data, and is rated with a CVSS score of 9.8, indicating a critical risk.

All installations of the ThemeREX Pizza House theme version 1.4.0 and earlier are affected. The vulnerability applies to the ThemeREX Pizza House theme, which is distributed under the ThemeREX vendor. The issue is relevant to any WordPress site that has chosen this theme, regardless of its versioning prior to 1.4.0.

The CVSS score of 9.8 sharply increases the severity, while the EPSS score of less than 1% suggests the probability of exploitation remains low but non‑zero. The vulnerability is not in the CISA KEV catalog, implying no known widespread exploitation at this time. Based on the description, it is inferred that an attacker can exploit the flaw by sending a malicious serialized string to the theme’s processing routine, which can result in arbitrary code execution. The likely attack vector is remote, requiring the attacker to supply the vulnerable serialized data to the theme. The consequences of a successful exploit include full code execution privileges on the affected WordPress site.