The vulnerability is an unauthenticated PHP Object Injection flaw found in the Photolia WordPress theme up to version 1.0.3. This defect allows an attacker to craft malicious object data that is deserialized by the theme without proper validation, enabling the injection of arbitrary PHP objects. The result is remote code execution on the affected WordPress installation, compromising confidentiality, integrity, and availability. The weakness is classified under CWE‑502, which denotes insecure deserialization.

Any WordPress site that has installed the ThemeRex Photolia theme version 1.0.3 or earlier is impacted. No additional product or version information was provided beyond the theme name and the 1.0.3 cutoff. Site administrators using WordPress versions that include this theme should verify the installed theme version and consider it vulnerable if it matches the affected range.

The CVSS score of 9.8 labels this flaw as Critical, reflecting tight remote usability and high impact. No EPSS score is available, so it is unclear how frequently the vulnerability is actively exploited, but the lack of a KEV listing suggests no confirmed large‑scale attacks yet. The likely attack vector is remote, unauthenticated via HTTP, as the injection occurs through a deserialization endpoint that accepts user supplied data without authentication checks. Given the severity, monitoring logs for suspicious deserialization attempts remains prudent.