ThemeRex Marcell EUVD-2026-112965

The affected product is the ThemeRex Marcell WordPress theme, versions 1.2.14 and earlier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated against affected installations with no user interaction, so the primary precondition is simply running a vulnerable Marcell version. The specific trigger - which request parameter or theme endpoint accepts the attacker-controlled serialized data - is not described in the available sources. A practical limiting factor for full impact is that PHP Object Injection generally requires a reachable POP gadget chain for meaningful consequences; the input does not confirm whether such a chain is present, so observed impact may vary by site configuration and installed plugins.

Multiple signals point to genuinely high priority rather than an inflated CVSS score. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable flaw of low attack complexity with high confidentiality, integrity, and availability impact (9.8), and the vuln.today Decision label is act_now, which supports treating this as urgent. CWE-502 (deserialization / PHP Object Injection) in a WordPress theme is a bug class historically abused for remote code execution when a suitable POP gadget chain is present. However, key corroborating signals are absent from the input: no EPSS probability, no CISA KEV listing, and no PoC or exploit reference are supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single source is a Patchstack database advisory, so the severity rests on one reporter's assessment rather than cross-confirmed exploitation data. Net: the metadata justifies prioritizing remediation (act_now plus unauthenticated 9.8), but the real-world weaponization and exploitation volume are unquantified because EPSS, KEV, and PoC data are all missing.

A remote, unauthenticated attacker sends a crafted request carrying a serialized PHP object to a vulnerable entry point in the Marcell theme, causing it to be deserialized (CWE-502). If a usable gadget chain is reachable in the theme or loaded WordPress code, this can escalate to actions such as arbitrary file operations or code execution; no public exploit is identified at time of analysis and the exact triggering parameter is not described in the available sources.