The vulnerability is an unauthenticated PHP Object Injection in WordPress Gamic theme versions 1.19 and earlier. This flaw, identified as CWE-502, allows an attacker to deserialize crafted objects without proper validation, potentially resulting in arbitrary code execution, data tampering, or defacement. The unrestricted data flow to PHP's unserialize function means that any user can trigger the injection by submitting specially crafted input.

Affected systems are installations of the Gamic theme by ThemeREX running version 1.19 or earlier. The exact patch level is unknown, and no version constraints beyond the ≤1.19 boundary are provided. Users running any of these legacy themes should evaluate their environment immediately.

The CVSS score of 9.8 classifies this flaw as critical, and though no EPSS score is available, the absence from KEV does not reduce its danger; attackers can exploit the flaw via unauthenticated HTTP requests targeting the theme's input handlers. The likely attack vector is through the web interface, where an attacker can send malicious payloads to the unserialize logic. Prompt action is warranted due to the high severity and ease of exploitation.