This vulnerability allows an attacker to inject arbitrary PHP objects through deserialization of untrusted data within the AncoraThemes Beelove WordPress theme, potentially resulting in remote code execution. The flaw is a classic PHP object injection, categorized as CWE-502, and violates the principle of data integrity by accepting untrusted input for object creation.

All installations of the AncoraThemes Beelove WordPress theme with version 1.2.6 or earlier are affected, regardless of usage patterns. No other vendors or products are listed; the issue originates solely from this theme.

The CVSS score of 9.8 indicates critical severity, and the low EPSS of less than 1 percent suggests a low probability of exploitation in the wild, though not entirely absent. The vulnerability is not listed in the CISA KEV catalog, yet its potential for remote code execution makes it highly desirable for attackers. Although the official attack vector is not explicitly documented, it is inferred from typical PHP object injection scenarios that an attacker could invoke the flaw through crafted HTTP requests or manipulated input handled by the theme.