The vulnerability is a deserialization of untrusted data flaw that allows PHP Object Injection. An attacker can supply crafted serialized payloads that are processed by the Jarvis theme, potentially influencing the application behavior. The weakness is described by CWE‑502 and carries a CVSS score of 9.8.

The affected vendor is AncoraThemes and the product is the Jarvis – Night Club, Concert, Festival WordPress theme. All releases from the initial public version up to and including 1.8.11 are vulnerable. Users running any of these versions should verify their installation and apply the fix if possible.

With a CVSS of 9.8 the risk is high. The EPSS score of less than 1% suggests that the exploit is not widely observed yet, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote: a malicious user can inject a serialized object via a web request that the theme processes, leading to potential security compromises. This vulnerability requires the attacker to deliver the payload to a code path that performs unserialization without proper validation, which is typical for PHP object injection attacks. Timely patching is essential to mitigate potential security risks.