The Angio theme for WordPress versions up to 1.1.1 contains a PHP object injection flaw that allows attackers to supply crafted serialized data, leading to arbitrary code execution on the server. This vulnerability, classified as CWE-502, can compromise the confidentiality, integrity, and availability of the website, enabling attackers to modify or delete content, exfiltrate data, or use the server as a foothold for further attacks.

Affected vendors and products include rascals’ Angio WordPress theme. All builds of Angio up to and including version 1.1.1 are impacted. Any WordPress site deploying these theme versions without additional isolation is at risk.

The CVSS score of 8.8 signals a high severity. EPSS data is not available, so the precise exploitation likelihood remains uncertain, but the public disclosure and classic nature of PHP object injection suggest a realistic attack surface. The vulnerability is not yet listed in the CISA KEV catalog. The attack vector is likely remote via standard HTTP requests to the theme, requiring the attacker to inject serialized payloads into inputs that are processed unsafely, which is achievable without privileged access on many configurations.