The Themeton FinAg WordPress theme contains a critical deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

This is a deserialization of untrusted data vulnerability (CWE-502) that allows for PHP object injection. It is exploitable by unauthenticated attackers, making it highly dangerous for internet-facing WordPress installations.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for unauthenticated remote code execution. Successful exploitation can lead to total system compromise, including the theft of sensitive database information, modification of site content, and potential use of the server for secondary attacks.

Immediate Action: No patch is currently available; users should immediately deactivate the FinAg theme and switch to an alternative, supported theme to mitigate the threat.

Proactive Monitoring: Monitor server logs for unexpected PHP errors or suspicious serialized data patterns in request parameters.

Compensating Controls: Implement a WAF with virtual patching capabilities to inspect incoming requests for serialized PHP objects and block malicious payloads.

Public Exploit Available: Unknown

Because this vulnerability is both critical and exploitable without authentication, it represents an immediate threat to infrastructure security. Deactivation of the theme is required immediately, and administrators must monitor the environment closely until the vendor provides a verified patch.