This vulnerability in ThemeREX Plumbing (<=1.6) is caused by unsafe deserialization of untrusted data, leading to unauthenticated PHP object injection. An attacker can exploit this flaw remotely without any privileges or user interaction to execute arbitrary code, potentially compromising the affected system fully. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary PHP code on the affected system without authentication, leading to full compromise of confidentiality, integrity, and availability of the system running ThemeREX Plumbing <=1.6.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to vulnerable installations and monitor for suspicious activity related to PHP object injection. Avoid exposing the affected application to untrusted networks.