CVE-2026-66672

CVE-2026-66672 in the Flatastic 2.0 WordPress theme is an unauthenticated PHP Object Injection vulnerability with a 9.8 CVSS but an unusually low 0.00386 EPSS. This gap is the most instructive thing about the CVE, and it should change how you evaluate the risk. The EPSS score likely reflects that Flatastic 2.0 is abandoned—not that it's hard to exploit. Premium WordPress themes follow a predictable lifecycle: compressed development, rapid abandonment when sales decline, and zero security maintenance after that point. There's no developer monitoring this code for new gadget chains, no one checking whether PHP version upgrades have broken or altered exploitation paths, and no security researcher analyzing what modern plugin combinations might add to the attack surface. The low EPSS measures current honeypot overlap, not actual exploitability. Abandoned software doesn't get scanned because nobody's running it except production sites that forgot it was there. What makes this operationally significant is the unauthenticated vector combined with the permanent blast radius. This isn't a vulnerability that gets discovered, exploited, and burned out. It's an entry point an attacker can hold indefinitely, waiting for the right class chain to appear. Every new plugin installed on a site running Flatastic potentially adds gadget chains the original developers never imagined. If that WordPress installation connects to CI/CD pipelines, staging environments, or third-party integrations—which most commercial deployments do—the initial compromise escalates to supply chain exposure. PHP 8.x has deprecated behaviors and hardened object instantiation in ways that break some legacy exploitation chains, but this cuts both ways: new class availability from modern plugins can silently expand the exploitability surface while the theme itself freezes in place. You cannot rely on the language evolving to protect you. If you're running Flatastic 2.0 in production, the realistic remediation path is migration or acceptance—not waiting for a patch that will never come. The EPSS/CVSS inversion for abandoned software should functionally read as exposure compounding with zero remediation probability. Given the permanent unauthenticated entry point, treat this as a question of when, not if, for any site still running this theme.

Reviewed through automated stages and approved by a human before publication.