The FC United WordPress theme, versions 1.1.1 and older, contains an unauthenticated PHP Object Injection flaw that is classified as CWE‑502. Based on the description, it is inferred that the vulnerability arises from the theme deserializing user‑controlled input without proper validation, allowing an attacker to craft a payload that, when deserialized, executes arbitrary PHP code on the affected WordPress site. This enables full control over the server, the ability to modify site data, and potential privilege escalation, directly compromising confidentiality, integrity, and availability of the website and underlying infrastructure.

Any WordPress installation that uses the axiomthemes FC United theme version 1.1.1 or earlier is affected. All sites running the FC United theme before any newer release that addresses this issue remain vulnerable, as no specific patch version is listed beyond the upper bound.

With a CVSS score of 9.8, the severity is critical. The flaw is unauthenticated, which implies that the likely attack vector is that an attacker can trigger the injection by sending a crafted HTTP request to the site—an approach that could be automated for public exploitation. Based on the description, the EPSS score is not available, but the high severity and lack of authentication suggest that exploitation is probable, making the threat real. The vulnerability is not yet listed in the CISA KEV catalog, but its potential for widespread compromise makes it a priority for rapid remediation.