The vulnerability in the Windsor theme allows an unauthenticated attacker to manipulate PHP object serialization, enabling the execution of arbitrary PHP code on the host web server. This flaw is rooted in insecure handling of serialized objects and results in complete loss of confidentiality, integrity, and availability for the affected site. The weakness is directly mapped to CWE-502, a PHP Object Injection scenario.

Any WordPress installation that uses the Windsor theme from ThemeREX with a version of 2.10 or earlier is affected. The vulnerability applies to all deployments of these theme releases, regardless of host environment or configuration.

The CVSS score of 9.8 indicates critical impact and no prerequisites for exploitation; an attacker with no authentication can deliver the malicious payload. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high severity coupled with the lack of authentication checks suggests a strong likelihood of exploitation should a caller target vulnerable sites. The attack vector is inferred to involve HTTP requests that trigger the theme’s object deserialization routine, as the description states the flaw exists in an unauthenticated context.