Angio Theme EUVD-2026-96460

Requires an authenticated WordPress account at Subscriber level (the lowest role, often available via open user registration) on a site running the Angio theme version 1.1.1 or earlier. The attacker must be able to reach the vulnerable endpoint over the network and supply attacker-controlled serialized data that the theme deserializes unsafely. Meaningful impact (code execution, file manipulation) further depends on the presence of a usable PHP object-injection gadget chain in the theme, active plugins, or WordPress core; without such a chain, practical impact is reduced. Limiting factors: authentication is mandatory (no anonymous exploitation), and the Angio theme must be installed and active.

This is a genuine priority-worthy flaw but not an emergency. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-privileged authentication - PR:L maps to a WordPress Subscriber account, which is the lowest tier and often self-registerable, so the authentication barrier is weak on sites permitting open registration. CWE-502 (deserialization) with C:H/I:H/A:H indicates full compromise of the vulnerable component is plausible if a usable POP gadget chain exists. However, several escalating signals are absent: no CISA KEV listing, no EPSS score was supplied, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. A critical caveat: PHP Object Injection impact is contingent on a reachable gadget chain in the theme, installed plugins, or WordPress core; CVSS encodes the worst-case (H/H/H) outcome, but real-world impact may be lower if no exploitable chain is present. Net: credible, remotely reachable, low-barrier bug meriting prompt patching, but currently theoretical rather than demonstrated in the wild.

An attacker registers or obtains a Subscriber-level account on a WordPress site running the Angio theme (<= 1.1.1), then sends a crafted request containing a malicious serialized PHP object to the vulnerable endpoint. If a suitable POP gadget chain is available in the theme, plugins, or core, deserialization triggers it to achieve outcomes such as arbitrary file operations or code execution. No public exploit code is identified at time of analysis, and exploitation requires authentication.