AncoraThemes Handyman theme for WordPress contains a deserialization defect that allows untrusted data to be processed as PHP objects. This flaw, known as object injection, can enable an attacker to execute arbitrary code on the affected server, potentially leading to full system compromise and data loss.

All WordPress sites using the Handyman theme version 1.4.7 or older are vulnerable. The problem was identified in every release from the first version up to and including 1.4.7.

The vulnerability carries a CVSS score of 9.8, indicating severe potential impact. Its EPSS score is reported as <1%, suggesting that worldwide exploitation is expected to be rare, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is likely through crafted serialized data submitted via the theme’s interfaces, though the precise prerequisites are not detailed in the advisory. Given the high severity and the possibility of remote code execution, the risk to systems that have not applied a fix remains significant.