A vulnerability in the AncoraThemes Anesta WordPress theme up to version 1.5.3 allows unauthenticated PHP Object Injection. Attackers can send specially crafted serialized data to the theme’s processing routines, causing arbitrary PHP code execution and full compromise of the affected WordPress installation. The issue is reflected in a CVSS score of 9.8, indicating critical severity.

The flaw affects WordPress installations that use the AncoraThemes Anesta theme version 1.5.3 or older. All installations running any of these versions are susceptible; no other products or plugin variants are known to be impacted.

With an unauthenticated attack vector, an attacker can initiate the exploit from the network layer without needing credentials. The EPSS value is not available, making the precise exploitation likelihood uncertain, but the high CVSS score and lack of mitigation on many sites suggest a significant risk. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation events yet, yet the potential for rapid exploitation remains high.