RexCoin Theme EUVD-2026-112948

Requires a WordPress site with the ThemeRex RexCoin theme installed and active at version 1.2.6 or earlier. Per the supplied CVSS vector (PR:N/UI:N), no authentication and no user interaction are needed, and the vector is network-reachable against a default install of the affected theme. The specific request, parameter, or deserialization sink that triggers the injection is not described in the available sources. As a PHP Object Injection flaw (CWE-502), realized impact depends on a usable gadget/POP chain being reachable in the theme or co-installed plugins - a factor the sources do not confirm - which is the main limiting condition on turning the injection into code execution or full compromise. No fixed version is listed in the available data.

Signals are mostly aligned toward high priority but rest on a thin single source. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact - consistent with CWE-502 PHP Object Injection, which can lead to code execution or data compromise when a suitable gadget chain is present. The vuln.today decision label is act_now, which signals urgency and should be treated as the operative prioritization. However, several key signals are MISSING rather than conflicting: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no confirmed proof-of-concept or working exploit code is indicated - the only reference is a Patchstack vulnerability-database advisory, not exploit code. There is therefore no confirmed real-world exploitation, and the high score reflects potential impact and ease of access rather than observed attacks. This is a genuine priority to patch given unauthenticated network reach on a public-facing WordPress theme, but the absence of EPSS/KEV/PoC data means the likelihood half of the risk picture is unverified and should be confirmed with the vendor/Patchstack.

A remote, unauthenticated attacker sends crafted input to a WordPress site running the RexCoin theme (<= 1.2.6) that reaches a vulnerable PHP deserialization call, injecting a malicious serialized object. If a usable gadget chain is present in the theme or loaded plugins, this can escalate to data compromise or code execution. No confirmed public exploit code is identified at time of analysis; the only available reference is a Patchstack advisory, and the exact trigger is not described in the available sources.