This vulnerability is a PHP Object Injection flaw that can be triggered without authentication. An attacker can supply specially crafted data that is unserialized by the Gunslinger theme, enabling the execution of arbitrary PHP code. The impact of exploitation is remote code execution, which can compromise the confidentiality, integrity, and availability of the affected site.

WordPress sites that use the ThemeREX Gunslinger theme version 1.11 or earlier are impacted. Any installation running a Gunslinger theme build up to and including 1.11 is vulnerable, while newer releases are not affected.

The CVSS score of 9.8 highlights critical severity. While the EPSS score is not available, the lack of a KEV listing does not mitigate the risk; the vulnerability remains actionable by any unauthenticated user. Exploitation would involve sending crafted requests that trigger the unserialization process, allowing an attacker to run arbitrary code on the server.