The vulnerability is a PHP Object Injection flaw in the Themify Builder plugin for WordPress. It allows an attacker to supply specially crafted serialized data that is unserialized by the plugin without proper validation, leading to arbitrary code execution on the web server. This can compromise the confidentiality, integrity, and availability of the site and potentially give the attacker full control over the affected installation.

The flaw affects any WordPress deployment running the Themify Builder plugin version 7.8.1 or earlier from the vendor ThemifyMe. All environments that use the vulnerable plugin are at risk. Users should verify if their installations still use a pre‑7.8.2 version.

The CVSS score is 8.8, indicating high severity. The EPSS score is not available, but the lack of listing in CISA KEV suggests no publicly known exploits yet. The likely attack vector is remote, relying on an attacker sending malicious serialized input to the plugin’s processing endpoint, which is typically reachable over the web. Because the plugin may run under the same user context as the web server, successful exploitation could lead to a full remote code execution.