The vulnerability is an unauthenticated PHP Object Injection flaw present in the WordPress Invetex theme versions 2.18 and earlier. An attacker can supply crafted serialized data that the theme passes to PHP's unserialize function without proper validation, potentially allowing the execution of arbitrary PHP code. This flaw aligns with the CWE‑502 weakness of deserializing untrusted data.

The affected product is the Invetex theme by ThemeREX, used within WordPress installations. All releases with version numbers 2.18 and earlier are vulnerable.

The CVSS score of 9.8 indicates critical severity and the vulnerability is not listed in the CISA KEV catalog. EPSS information is not available, but given the unauthenticated nature of the flaw, the attack vector is likely remote and does not require prior authentication. The likely attack vector is inferred to be any input stream the theme processes, such as form submissions or URL parameters, where an attacker can inject malicious serialized payloads.