This vulnerability is an unauthenticated PHP Object Injection flaw in the Agora WordPress theme, allowing an attacker to deserialize crafted data and instantiate arbitrary PHP objects. The injected objects can execute code on the server, leading to full remote code execution and complete compromise of the affected WordPress site. The weakness is classified as CWE‑502, indicating deserialization of untrusted data.

WordPress sites using the AncoraThemes Agora theme, version 1.9 or earlier. The issue is limited to these theme releases and does not affect newer major versions of the theme.

The CVSS score of 9.8 marks the flaw as critical and the lack of directives in the EPSS pool means the probability of exploitation at present is unknown but the high severity and unauthenticated nature imply it is a likely target for automated scans. The vulnerability is not listed in the CISA KEV catalog, yet its impact and widespread availability make it attractive for attackers. Exploitation requires only a crafted HTTP request to the vulnerable theme’s endpoint, without authentication or special privileges.