This vulnerability (CVE-2026-65578) involves unauthenticated PHP Object Injection in AncoraThemes Agora software versions up to and including 1.9. The root cause is deserialization of untrusted data (CWE-502), which can allow an attacker to execute arbitrary code remotely without authentication. The CVSS 3.1 score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and no known exploits in the wild have been reported.

Successful exploitation can lead to remote code execution by unauthenticated attackers, resulting in full system compromise including loss of confidentiality, integrity, and availability of the affected application and potentially the underlying server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable components if possible and monitor for updates from AncoraThemes.