Deserialization of untrusted data in the WordPress Tennis Club theme enables PHP Object Injection, a vulnerability that can allow an attacker to execute arbitrary code, modify or delete data, and potentially take full control of the affected server. This weakness corresponds to CWE‑502 and carries a CVSS score of 9.8, indicating critical severity. The flaw arises when the theme processes serialized input without proper validation, giving an attacker the opportunity to inject malicious objects.

The vulnerability affects ThemeREX's Tennis Club WordPress theme versions up to and including 1.2.3. Websites that have installed this theme and have not applied a newer patch are at risk.

The attack vector is likely through any input path provided by the theme that accepts serialized data, such as importing settings or using the theme’s widget options. Exploit requires crafting a malicious serialized payload which the theme then blindly deserializes. Although the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, the high CVSS score and the nature of object injection make it a high‑risk vulnerability for exposed websites, warranting urgent attention.