The vulnerability is a deserialization of untrusted data flaw in the ThemeREX Addons plugin up to version 2.36.1.1, allowing an attacker to create or manipulate PHP objects that are later unserialized, potentially leading to arbitrary code execution or application compromise. The flaw is classified as CWE-502.

The affected product is the WordPress ThemeREX Addons plugin for ThemeREX Group, with all releases at or below version 2.36.1.1. Users running those versions are impacted.

The CVSS score of 9.8 marks this vulnerability as critical, while the EPSS score is currently less than 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The CVE description indicates that untrusted serialized data can be injected, potentially enabling arbitrary code execution if an attacker can supply malicious data. The description does not specify whether authentication is required or the exact input vector, so the specific attack vector is not confirmed; it may involve the plugin’s input fields or API endpoints. An attacker who succeeds could gain full control over the WordPress site.