ThemeREX Gamezone EUVD-2026-112978

The affected product must be in use: the ThemeREX Gamezone WordPress theme at version 1.1.11 or earlier, installed and active on the site. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and requires no user interaction, so any internet-reachable site running the vulnerable theme is exposed. LIMITING FACTORS: realized impact of a CWE-502 object injection depends on a usable POP gadget chain being reachable in the theme, WordPress core, or co-installed plugins; the available sources do not describe the trigger or confirm which concrete impacts are achievable, so actual exploitability on a given site may be narrower than the 9.8 implies. No fixed version is provided in the evidence to confirm the upgrade target.

Multiple signals point to genuine priority rather than a paper-high CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable flaw requiring no authentication and no user interaction, with full confidentiality, integrity, and availability impact (C:H/I:H/A:H), yielding 9.8. The Patchstack-sourced decision label is 'act_now', which aligns with the unauthenticated, low-complexity profile. However, key corroborating signals are MISSING: no EPSS exploitation-probability score is provided, the CVE is NOT in CISA KEV (so there is no confirmation of active exploitation), and no verified public exploit code is referenced. The only reference is the Patchstack advisory itself. So the high score and 'act_now' label rest on the intrinsic severity of an unauthenticated PHP object injection, not on observed in-the-wild activity. One caveat: CWE-502 object injection impact in practice depends on reachable POP gadget chains in the theme, WordPress core, or co-installed plugins, but the available sources do not describe the trigger or confirm which impacts are achievable, so the uniform C:H/I:H/A:H should be treated as the vendor's worst-case assessment rather than independently verified.

A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Gamezone theme (<= 1.1.11) containing a malicious serialized PHP object, which the theme deserializes untrusted input (CWE-502). If a suitable gadget chain is present, the injected object can be leveraged toward code execution, data disclosure, or site compromise. No public exploit code is identified at time of analysis, and the precise trigger is not described in the available sources.