If an unauthenticated attacker can supply crafted PHP serialized objects to the WordPress Juno theme (versions ≤ 2.25), the vulnerability known as PHP Object Injection (CWE‑502) permits arbitrary instantiation of PHP objects. By controlling the object payload, an attacker can invoke magic methods or otherwise execute malicious code during deserialization, giving them the ability to run arbitrary code on the web server and compromise the entire site. At the time of analysis, the CVE that the flaw is exploitable without authentication and can lead to full remote code execution.

The vulnerability affects the WordPress Juno theme developed by ThemeREX. All installations running Juno theme version 2.25 or earlier are impacted. No additional versions are listed in the available data.

The CVSS score of 9.8 classifies the issue as critical and places it in the high‑risk category. EPSS data is not available, so the exploitation probability cannot be quantified from current datasets. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at the time of assessment. The overall attack vector is inferred to be remote, unauthenticated, and based on standard HTTP requests that the WordPress site accepts, allowing an attacker to inject malicious serialized payloads and trigger PHP object injection.