The vulnerability is an unauthenticated PHP Object Injection within the ShiftCV theme versions up to 3.0.14. Because the theme deserializes user‑supplied data without proper validation, an attacker can inject serialized PHP objects that are instantiated during normal runtime. This flaw, classified as CWE-502, allows an attacker to execute arbitrary code, effectively providing remote code execution on the affected WordPress site.

The affected software is the WordPress theme ShiftCV by ThemeREX, versions 3.0.14 and below. No additional vendor or product names are listed. Because the theme is a WordPress plugin component, all installations of the affected version are potentially vulnerable.

The CVSS score of 9.8 indicates a critical severity and the EPSS score is not available, but the lack of an EPSS value does not mean the vulnerability is unlikely; it simply means it is not quantified. The vulnerability is not currently listed in the CISA KEV catalog. Attackers could exploit the flaw by sending specially crafted requests to any public endpoint that loads the theme; authentication is not required, making the attack vector web‑based and remote. Once the attacker successfully injects a malicious object, they could gain full control of the WordPress environment.