A critical unauthenticated PHP Object Injection vulnerability in the Axiomthemes AI ANN theme enables remote attackers to compromise the integrity and availability of the affected system.

This flaw is a result of unsafe deserialization of untrusted data, specifically falling under CWE-502. An unauthenticated attacker can leverage this to inject malicious objects that lead to arbitrary code execution with the privileges of the web server.

The CVSS score of 9.8 underscores the severe potential for total system takeover. Exploitation of this vulnerability could lead to the theft of sensitive proprietary data, unauthorized modification of website content, and the potential for lateral movement into the wider internal network.

Immediate Action: Apply the latest security update released by Axiomthemes for the AI ANN theme to address the deserialization vulnerability.

Proactive Monitoring: Monitor web server logs for irregular query strings or POST requests that appear to contain serialized object signatures.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block requests that attempt to exploit PHP deserialization vulnerabilities.

Public Exploit Available: No

Security teams must treat this vulnerability with high urgency given its critical CVSS rating. Ensure the AI ANN theme is updated to the latest version immediately to close the injection vector and protect against potential remote exploitation.