Unauthenticated PHP Object Injection in the WordPress Original theme allows an attacker to instantiate arbitrary PHP objects, which can lead to execution of malicious code on the web server. This flaw jeopardizes the confidentiality, integrity, and availability of the affected WordPress installation, potentially giving attackers full control over the host.

The vulnerability affects the AxiomThemes Original WordPress theme for all releases up to and including version 1.9.0. Users running any of these versions are therefore exposed.

The CVSS score of 9.8 categorizes this issue as critical. Because the flaw is unauthenticated, an attacker only needs to craft a malicious request to the site; no prior login is required. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Given the high severity and the low exploitation barrier implied by unauthenticated access, the risk remains significant and warrants immediate attention.