AncoraThemes Fish House plugin versions up to 1.2.7 suffer from a deserialization of untrusted data vulnerability that enables object injection attacks. This vulnerability allows remote attackers to send crafted serialized data to the application, which is then deserialized insecurely, leading to potential arbitrary code execution or other severe impacts. The CVSS 3.1 score of 9.8 reflects the critical nature of this vulnerability, with an attack vector over the network, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and the affected product is not a cloud service.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized disclosure of information, modification or destruction of data, and disruption of service. Given the critical CVSS score and the nature of object injection via deserialization, attackers could execute arbitrary code or commands remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Fish House plugin if feasible. Monitor official AncoraThemes communications for updates and patches addressing this vulnerability.