The vulnerability is an unauthenticated PHP Object Injection flaw in the WordPress Gamezone theme versions 1.1.11 and older. The flaw allows an attacker to craft serialized PHP objects that are deserialized during normal operation of the theme. When the payload is accepted, the attacker can control the object's properties and invoke arbitrary PHP code on the server, resulting in remote code execution. This gives the attacker full control over the affected WordPress site, including reading, modifying or deleting files, creating backdoor accounts, or escalating privileges. Because no authentication is required, any visitor can trigger the flaw.

The affected product is the ThemeREX Gamezone WordPress theme. Versions up to and including 1.1.11 contain the flaw. Users must verify the installed theme version and determine if it is on the insecure release line. The problem exists in the core theme code that handles serialization and does not correctly sanitize or restrict object types.

The CVSS score of 9.8 and the lack of authentication requirement mark this vulnerability as a high severity risk. The EPSS score is not available, so while the exploitation probability is not quantified, the absence of any known usage barriers means that the vulnerability can be easily exploited over the web. The CVE is not listed in the CISA KEV database, but the high score indicates that vendors and customers should treat it with the same urgency as known exploited vulnerabilities.