ThemeREX Royal Event EUVD-2026-114283

The site must run the ThemeREX Royal Event theme at a version up to and including 2.0, and attacker-supplied serialized data must reach a vulnerable unserialize() call (CWE-502 / PHP object injection). The CVSS vector indicates PR:N/UI:N (unauthenticated, no user interaction) and AV:N (network), so no special authentication or configuration is indicated by the available data. The principal limiting factor is inherent to object injection: meaningful impact depends on a usable POP gadget chain being present in the theme, WordPress core, or an installed plugin; the exact triggering endpoint/parameter and the existence of a working chain are not described in the available sources.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full impact, and the vuln.today decision label is act_now, both pointing to high urgency. However, the severity-boosting signals are not all independently corroborated: no CISA KEV listing is present (so there is no confirmation of active exploitation), and no EPSS probability was supplied, so the real-world exploitation likelihood cannot be quantified from this data. The single reference is a Patchstack advisory, not an exploit reference, so no public exploit is identified. The core caveat for CWE-502 object injection is that the 9.8 impact assumes a usable POP gadget chain is reachable; the description states only that the flaw 'allows Object Injection' and does not describe the trigger or confirm a working end-to-end gadget chain, so the C:H/I:H/A:H rating is a worst-case assessment rather than a demonstrated outcome. Net: prioritize because of the act_now label, unauthenticated network vector, and WordPress attack surface, but treat the maximal impact and exploitability as vendor-assessed potential, not confirmed in-the-wild fact.

A remote attacker sends a crafted request carrying a malicious serialized PHP object to an endpoint of a site running the Royal Event theme (≤ 2.0), where it reaches an unserialize() call. If a suitable property-oriented programming gadget chain exists in the theme, WordPress core, or an installed plugin, the injected object can be abused for file operations, SQL interaction, or code execution. No public exploit code is identified at time of analysis; the single reference is the Patchstack advisory, not a PoC.