CVE-2026-66567: WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Affected Software
1 affected component
WordPress Anesta theme<=1.5.3
Event History
Oct 10, 2026
CVE Published
via MITRE·07:36 PM
Data Sourced
via MITRE·07:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require a WordPress account or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is needed for exploitation.
2
Can this be attacked remotely?
Yes. The CVSS vector rates the attack vector as network-based, indicating that a remotely reachable affected site may be exposed.
3
What impact is indicated by the severity assessment?
The assessment rates confidentiality, integrity, and availability impact as high, with a critical CVSS score of 9.8.