The Flatastic theme introduced in WordPress includes an unauthenticated PHP Object Injection flaw in all releases up to version 2.0. This weakness allows an attacker to supply malicious serialized data that is instantiated by the theme’s code, enabling the attacker to manipulate object properties and trigger arbitrary PHP code execution. The consequence is complete compromise of the affected site, granting the attacker full control over files and data on the server.

The vulnerability affects the Flatastic theme developed by Monkeysan. Any WordPress installation that has the Flatastic theme version 2.0 or earlier enabled is susceptible. These are typically used as the active theme or as a special theme within the WordPress dashboard.

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be unauthenticated HTTP requests that reach the theme’s serialized data processing logic—such as configuration or Ajax endpoints—where the attacker can deliver crafted data. Because authentication is not required, every public WordPress site running the affected theme is exposed to a potentially remote code execution exploit if the attacker succeeds.