Technical impact
The vulnerability is a PHP deserialization flaw in the AncoraThemes Jardi theme for WordPress that allows an attacker to inject objects into the theme’s processing pipeline. If an attacker can supply an untrusted serialized payload that the theme deserializes, the flaw can be used to execute arbitrary PHP code with the permissions of the WordPress site, giving full control over the server. This weakness is classified as CWE‑502, indicating a deserialization of untrusted data.
Affected Systems
AncoraThemes Jardi theme for WordPress, all releases from the initial package through version 1.7.2 are affected. The vulnerability applies to any WordPress installation that has the Jardi theme active and has not installed an update newer than 1.7.2.
Risk and Exploitability
The CVSS score of 9.8 denotes critical severity, while the low EPSS score of less than 1% suggests that the vulnerability is not currently widely exploited. The issue is not listed in the CISA KEV catalog, indicating that known active exploitation is not reported. Based on the description, it is inferred that the attack vector likely involves a user‑controlled serialized input that triggers the vulnerable deserialization routine via a WordPress page or plugin; when exploited, the attacker could achieve remote code execution with site‑wide privileges.
