This vulnerability arises from the Melody theme's deserialization of untrusted data. Attackers can craft serialized PHP objects that, when processed by the theme, cause arbitrary object injection. The flaw qualifies as PHP Object Injection and maps to CWE‑502. If exploited, it can lead to remote code execution, allowing an attacker to compromise the entire WordPress site, exfiltrate data, modify files, or disrupt availability.

The Melody theme by AncoraThemes, in any WordPress site that installed any release up to version 1.6.3, is affected. The vulnerability is present in all versions from the first release through 1.6.3. No specific minor patch or version detail beyond the ≤ 1.6.3 boundary is supplied.

The CVSS score of 8.1 denotes high severity, while an EPSS score below 1 % indicates that the exploit probability is currently low. The vulnerability is not listed in the CISA KEV catalog, implying no widespread attacks have been observed yet. The attack vector appears to be supply of malicious serialized data via any WordPress endpoint that the Melody theme processes, which is inferred from the description; explicit exploitation instructions are not provided in the data. Nonetheless, because the flaw permits arbitrary code execution, urgent patching is recommended.