The vulnerability is an unauthenticated PHP Object Injection in the Tipsy WordPress theme versions 1.6 and earlier. An attacker can supply crafted serialized data that is parsed on the server, potentially allowing arbitrary code execution or other destructive actions. The lack of input validation on the deserialization process enables injection of arbitrary PHP objects.

Affected systems are WordPress sites that have the Tipsy theme by ThemeREX installed, specifically versions 1.6 and older. The theme is integrated into the WordPress CMS; any site using those versions is at risk.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, but the vulnerability does not require prior authentication and can be triggered by any visitor submitting a crafted HTTP request that invokes the theme’s object deserialization logic. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve sending a malicious serialized payload to the theme’s processing endpoint, resulting in remote code execution. Consequently, the risk is high if the theme remains unpatched.