Deserialization of untrusted data in the Morning Records WordPress theme introduces a PHP Object Injection vulnerability. When an attacker can supply crafted serialized payloads, the theme’s deserialization routine may instantiate objects with attacker‑controlled properties, allowing the execution of arbitrary code. The flaw arises from the theme handling of serialized input without validation, creating a path for remote code execution or code injection.

All WordPress installations that use the AncoraThemes Morning Records theme in version 1.2 or earlier are impacted. Versions older than the first release are also affected. Sites that have upgraded beyond 1.2 are not vulnerable to this specific flaw.

The vulnerability carries a CVSS score of 8.1, indicating high severity, while the EPSS score is below 1%, suggesting a low likelihood of active exploitation. It is not listed in the CISA KEV catalog, meaning there are no confirmed large‑scale attacks reported. The likely attack vector is remote, via any input path that the theme processes, such as form submissions, URL parameters, or API calls, where a crafted serialized payload can be injected. Successful exploitation would grant the attacker remote code execution capabilities, compromising confidentiality, integrity, and availability of the affected site.