The vulnerability is an unauthenticated PHP Object Injection flaw present in all Printy theme releases up to and including version 1.13.0. This weakness allows an attacker to send specially crafted input that is deserialized by the theme, resulting in the execution of arbitrary PHP code. Because the flaw is independent of authentication, a threat actor can trigger it from any network location that can reach the vulnerable WordPress site, leading to complete compromise of the site and its underlying server.

WordPress installations using the Printy theme from ThemeREX with a version of 1.13.0 or earlier are affected. This includes any site that has not applied the 1.13.1 (or newer) release that removes the insecure deserialization point.

With a CVSS score of 9.8, the flaw is considered critical. Although the EPSS score is not publicly available, the lack of listed KEV status does not diminish the urgency; the attack vector is remote and unauthenticated, offering a straightforward path for exploitation if the site is exposed to the internet.