{"id":"CVE-2026-66567","published":"2026-10-10T20:16:46.223","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/anesta/vulnerability/wordpress-anesta-theme-1-5-3-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability allows unauthenticated attackers to inject arbitrary PHP objects into the application, leading to remote code execution, data compromise, and full system access. This affects Anesta versions up to 1.5.3.","exploitability":"Exploitation is straightforward with no authentication required, though it may depend on specific object serialization patterns in the target application.","blast_radius":"The vulnerability could impact all installations running Anesta 1.5.3 or earlier, potentially allowing attackers to execute arbitrary code, steal sensitive data, and compromise entire systems.","remediation":"Upgrade to Anesta version 1.5.4 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:28.472Z"}}