An unauthenticated PHP Object Injection flaw exists in the Qwery WordPress theme versions up to 3.6.1. The vulnerability allows an attacker to supply malicious serialized data that is unserialized by the theme’s code, leading to arbitrary PHP code execution on the web server. An attacker could create or modify files, install malware, or obtain full control of the hosted site, thereby compromising confidentiality, integrity, and availability of the infrastructure.

This issue affects deployments of the AncoraThemes Qwery theme that are running version 3.6.1 or earlier on WordPress sites. The flaw is specific to the theme code and does not require any additional plugins or custom code to trigger.

The CVSS score of 9.8 signals a high severity that permits remote code execution without authentication. Because the vulnerability is accessed through the theme’s public interface, an attacker can exploit it from any internet‑connected system. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the lack of a mitigation means a wide attack surface remains. Exploitation would typically involve crafting a serialized PHP payload and triggering the theme’s deserialization logic via a crafted request.