Unauthenticated PHP Object Injection allows an attacker to instantiate arbitrary PHP objects within the WordPress Adrena theme, potentially leading to code execution, data exfiltration, or further compromise. The weakness is a classic PHP serialization deserialization flaw and is classified as CWE‑502. Affected systems are websites running the AncoraThemes Adrena theme version 1.2.14 or earlier. The vulnerability is present in all builds of the theme prior to version 1.2.15. A site that has not yet upgraded to a later release is susceptible. The CVSS score of 9.8 indicates critical severity, but the EPSS score is unavailable and the issue is not currently listed in the CISA KEV catalog. The likely attack vector is web‑based, using the theme’s vulnerable entry points, and requires no authentication.

WordPress sites using the AncoraThemes Adrena theme up to and including version 1.2.14.

Given the high CVSS score and the lack of mitigation, an attacker with network or web access can exploit the flaw to achieve arbitrary code execution. While no published exploits are reported, the vulnerability’s nature and severity warrant immediate action. The KEV absence does not diminish risk.