AncoraThemes SevenHills theme suffers from a deserialization of untrusted data flaw that permits PHP object injection. Attackers can craft malicious serialized payloads that, when processed by the theme, result in arbitrary code execution. The weakness is classified as CWE-502, indicating that the application fails to protect against potentially dangerous sent data.

This vulnerability affects the AncoraThemes SevenHills WordPress theme for all releases up to and including version 1.6.2. No higher versions are listed as affected.

The CVSS score of 9.8 signals a critical severity, and the EPSS score of less than 1% suggests that exploitation is unlikely but still possible. It is not listed in the CISA KEV catalog. The likely attack vector is any pathway that delivers untrusted serialized data into the theme’s processing logic, such as user‑submitted content or REST endpoints. Successful exploitation would allow an attacker to run arbitrary code on the webserver, compromising confidentiality, integrity and availability.