The Grand Photography theme on WordPress implements deserialization of untrusted PHP data, which enables object injection as identified by CWE-502. An attacker who can supply a crafted serialized payload can cause WordPress to instantiate malicious objects, leading to execution of arbitrary PHP code and granting the attacker complete control over the site and its underlying server.

Any WordPress installation that includes the ThemeGoods Grand Photography theme version 5.7.8 or earlier is vulnerable. The flaw can be triggered during theme loading, administrative functions, or any operation that processes serialized theme data, regardless of whether the theme is actively selected.

The CVSS score of 9.8 places the vulnerability in the Critical range, indicating a high severity level. The EPSS score of less than 1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based solely on the description, it is inferred that the attack vector involves supplying a malicious serialized object to the theme during normal WordPress execution. If exploited, the attacker would gain full compromise of the WordPress installation, affecting confidentiality, integrity, and availability.