Anesta WordPress theme: Unauthenticated PHP object injection

Summary

The Anesta WordPress theme by AncoraThemes, in versions up to and including 1.5.3, contains an unauthenticated PHP object injection flaw (CWE-502). An remote attacker can send crafted serialized data to the site without logging in, which may allow manipulation of server-side processing and, depending on the installed plugins and theme, code execution. No vendor fix, confirmed exploitation or public proof of concept was found at the time of research, but the CVSS score is 9.8 and the Patchstack advisory rates it as high priority.

Affected

• AncoraThemes Anesta WordPress theme, versions up to and including 1.5.3

Fixed in

• Unknown. No vendor advisory or confirmed fixed version was found.
• A third-party report states that a vendor patch is pending (unconfirmed).
• Do not assume that version 1.6.0 fixes this CVE without vendor confirmation.

Workaround

• Restrict access to the site and its administration area by VPN or IP allowlist.
• Remove or replace the theme if it is not business-critical.
• Ask your hosting provider or WAF vendor whether a virtual patch is available (none confirmed).
• Consider restricting PHP unserialize() and the phar stream wrapper where not required, after testing.

Exploitation

• Exploited in the wild: none known.
• CISA SSVC (Vulnrichment): Exploitation none, Automatable yes, Technical Impact total.
• Public proof of concept: none found.
• Patchstack describes the vulnerability as likely to be exploited in mass campaigns.

Our recommendation

• Inventory all WordPress sites and check for the anesta theme folder and its version.
• Restrict public exposure now, especially for sites not meant to be internet-facing.
• Remove or replace the theme if no vendor fix is available.
• Check the Patchstack advisory and the vendor for updates and re-check NVD.
• Review web server logs and check the sites for compromise, such as unknown admin users or modified files.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-66567 app.opencve.io
• HOL Guard advisory hol.org
• The Hacker Wire report www.thehackerwire.com
• Vulners Rapid7 record vulners.com
• ThemeForest Anesta listing themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:23.