Deserialization of untrusted data in the ThemeREX Classter theme allows attackers to inject PHP objects. This PHP object injection flaw can lead to arbitrary code execution, data tampering or leakage, and is a client‑side vulnerability with severe impact as indicated by a CVSS score of 9.8. The weakness is classified as deserialization‑related (CWE‑502).

WordPress sites that use the Classter theme version 2.5 or earlier are affected. The vulnerability applies to all releases from the theme’s initial availability through version 2.5, with no specific patch version identified in the entry. No additional platform enumeration is available beyond the theme name.

The flaw is highly exploitable, yet the EPSS score is reported as less than 1%, suggesting limited exploitation activity to date. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known widespread incidents. Attackers would likely need to deliver a crafted serialized payload via an HTTP request to a vulnerable endpoint in the theme to trigger the deserialization and achieve remote code execution. The high CVSS base score reflects a very high severity and wide impact across all affected installations.