A deserialization flaw in the rascals Vex theme allows an attacker to inject PHP objects into the system, potentially leading to remote code execution or similar malicious actions. The vulnerability arises from processing untrusted serialized data without proper validation, enabling arbitrary object creation if crafted input reaches backend logic. The impact spans privacy, integrity, and availability, allowing an attacker to run arbitrary code on the affected WordPress site.

The issue affects the rascals Vex WordPress theme on all releases older than version 1.2.9. This includes every installation using any Vex version from the initial release up to, but not including, 1.2.9, typically found on standard WordPress installations.

The CVSS score of 8.8 classifies this flaw as high severity. EPSS indicates a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The attack likely proceeds by sending a specially crafted serialized payload through a vulnerable input point in the theme, which, when deserialized, instantiates attacker‑controlled objects and executes code. No public exploit is documented in the CVE source, but the nature of object injection makes it a significant threat if combined with other vulnerabilities or elevated privileges.