The vulnerability is a PHP Object Injection flaw that allows attackers to insert arbitrary serialized objects into the WordPress AI ANN theme without authentication. Such injection can lead to the execution of unintended code, modification of theme configuration, or tampering with site content. The flaw is categorized as CWE-502, indicating a generic object serialization vulnerability.

Axiomthemes’ AI ANN WordPress theme, versions 1.29.0 and earlier, is affected.

The CVSS score of 9.8 marks this issue as critical, suggesting that exploitation could have a major impact on confidentiality, integrity, and availability. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying limited evidence of exploitation in the wild. The likely attack vector is purely web‑based, relying on unauthenticated users submitting serialized payloads to the theme’s processing endpoints. Due to the nature of PHP Object Injection, if an attacker can control the object context, the risk of remote code execution is high.