The vulnerability is an unauthenticated PHP Object Injection flaw in WordPress Good Homes theme versions up to 1.3.13. Based on the description, it is inferred that an attacker can supply crafted serialized data that is unserialized by the theme, enabling the creation of arbitrary PHP objects. If the attacker gains control over the deserialization input, they can trigger execution of code in the context of the WordPress site, potentially resulting in remote code execution, data disclosure or modification.

Affected: ThemeREX Good Homes WordPress theme, versions 1.3.13 and all earlier releases.

The CVSS score is 9.8, indicating critical severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated input that allows arbitrary serialized data to be processed by the theme. An exploited vulnerability could enable an attacker to execute arbitrary PHP code on the server.