The vulnerability is a deserialization of untrusted data that permits PHP Object Injection within the Anona theme for WordPress. This flaw allows an attacker to construct malicious serialized payloads that, when processed by the theme, can lead to arbitrary code execution or other severe compromise. The weakness is classified as CWE‑502 and exposes the full ability for an attacker to take control of the affected site.

The issue affects the WordPress Anona theme from version n/a through 8.0, distributed by the vendor AivahThemes under the product name Anona. WordPress installations running any of these versions are potentially vulnerable.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a relatively low current exploitation probability. Because the flaw involves PHP object injection, the most likely attack vector is through any user input that is passed to the theme’s unserialize function, such as custom fields or theme configuration options; this inference is drawn from the description of the vulnerability. The vulnerability is not listed in the CISA KEV catalog.