ThemeREX Addons EUVD-2026-76197

The affected ThemeREX Addons plugin (trx_addons) below version 2.45.0 must be installed and active - commonly present because it is bundled with ThemeREX commercial themes. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required for the injection primitive itself. The limiting factor is impact realization: full remote code execution or high-integrity effects require a usable PHP POP gadget chain in the loaded codebase (plugin, theme, or WordPress core); without such a chain the object injection may be constrained to lower-impact outcomes.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects a network-reachable, unauthenticated flaw with no user interaction, which is the maximal exploitability profile. However, the description labels this a PHP Object Injection primitive, and the full high-impact triad depends on a usable gadget chain being present - a real but often non-trivial precondition - so the 9.8 may overstate impact where no gadget chain exists. No EPSS score, KEV listing, or POC was provided; absence of these signals suggests no confirmed widespread exploitation yet, but object-injection bugs in widely bundled plugins are attractive targets and can be weaponized quickly once a gadget is published. Treat as a high-priority patch given the unauthenticated network vector and the plugin's broad distribution, while recognizing exploitability is gadget-dependent.

An attacker identifies a WordPress site running a ThemeREX theme with ThemeREX Addons below 2.45.0, then sends a crafted request containing a serialized PHP object to a vulnerable unauthenticated handler. If a POP gadget chain exists among the site's active plugins, theme, or core, the injected object triggers it on deserialization - potentially leading to arbitrary file write, SQL manipulation, or remote code execution. No public POC was provided at time of analysis.