The Education Center theme for WordPress suffers from an unauthenticated PHP Object Injection flaw in all releases up to and including 3.6.12. Because the attacker can control the serialized data passed to the application, an attacker can cause the PHP interpreter to instantiate unintended objects, which can lead to arbitrary code execution or other critical changes in the application’s state. The weakness falls under CWE‑502, which signifies improper deserialization of untrusted data, a classic vector for remote code execution.

The vulnerability is present in the ThemeREX Education Center theme for WordPress. Any deployment using a version equal to or earlier than 3.6.12 is affected. No other ThemeREX products are listed as vulnerable.

A CVSS score of 9.8 classifies this flaw as critical. The flaw is exploitable without authentication and therefore any user with access to the public web interface can trigger it. EPSS data is not available, so current exploitation probability is unknown, yet the lack of an authentication requirement suggests a high likelihood of attack. The vulnerability is not currently listed in the CISA KEV catalog, but the high severity mandates immediate action.