Anesta WordPress Theme EUVD-2026-96521

Exploitation requires the target site to run the Anesta WordPress theme at version 1.5.3 or earlier and to expose the vulnerable input that reaches an unsafe unserialize() call; no authentication or user interaction is needed (PR:N/UI:N). The practical limiting factor for PHP Object Injection is the presence of a usable POP gadget chain in the theme, WordPress core, or another active plugin - without a reachable gadget chain, the injection may not yield code execution or meaningful impact despite the 9.8 rating. The specific vulnerable parameter/endpoint is not named in the provided data and should be confirmed from the Patchstack advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact - on paper a top-priority issue. The underlying weakness (CWE-502, PHP Object Injection) supports that rating ONLY when an exploitable POP gadget chain is reachable in the theme or a loaded WordPress plugin/core; absent a usable gadget chain, real-world impact of object injection is frequently lower than the 9.8 implies, so the CVSS likely represents a worst-case ceiling rather than a guaranteed outcome. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is a single Patchstack advisory. The signals are therefore consistent (high CVSS matched by an unauthenticated network CWE-502) but thin on corroboration - no independent exploitation-probability or exploitation-status data accompanies the severity rating, so the priority rests on severity and ease of exploitation rather than on confirmed in-the-wild activity.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Anesta theme (<= 1.5.3) containing a serialized PHP object in an input that the theme passes to unserialize(). If a suitable POP gadget chain is present in the theme, WordPress core, or another active plugin, the injected object triggers that chain on deserialization, potentially leading to code execution, file operations, or data disclosure. No public POC is identified in the provided data.