Deserialization of untrusted data in the ThemeREX Good Energy theme allows PHP Object Injection, which can be leveraged by an attacker to execute arbitrary code on the affected WordPress site. The flaw arises from processing untrusted serialized input without adequate validation, exposing the site to severe confidentiality, integrity, and availability risks.

The vulnerability impacts the Good Energy theme by ThemeREX, affecting all installations from the earliest available version through version 1.7.7. Any WordPress deployment using this theme is potentially exposed.

The flaw carries a CVSS score of 9.8, indicating critical severity. Although its EPSS score is below 1%, the high severity and the nature of the vulnerability make it an attractive target for attackers once access to the theme’s serialization endpoint is discovered. The vulnerability is not listed in the CISA KEV catalog but remains a high‑risk threat. The likely attack vector is via crafted HTTP requests that supply malicious serialized payloads to the theme’s deserialization processing code; the attacker can inject objects that execute arbitrary PHP code. A successful exploitation would grant the attacker full control over the affected web server.