ThemeREX Royal Event theme versions up to 2.0 contain a deserialization flaw that permits arbitrary object injection. An attacker can supply crafted serialized data that, when processed by the theme, causes PHP to instantiate objects with malicious payloads. The vulnerability is classified as CWE‑502 and can lead to execution of arbitrary code or severe compromise of confidentiality and integrity of the site.

Any WordPress site using the Royal Event theme, from the earliest release up to and including version 2.0, is vulnerable. This includes all installations that have not yet applied the latest update from ThemeREX.

With a CVSS score of 9.8, the flaw is considered critical. Although EPSS data is unavailable and the vulnerability is not yet listed in the CISA KEV catalog, the potential for remote exploitation is significant. The likely attack vector would involve supplying malicious serialized payloads via HTTP requests to any theme‑provided endpoints or widgets. The lack of mitigation in the current releases means an attacker could achieve remote code execution if the site is accessible.