This vulnerability in ThemeREX Tennis Club (<= 1.2.3) arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. Exploitation requires no privileges or user interaction and can be performed remotely over the network. The CVSS 3.1 base score of 9.8 reflects high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation can lead to full compromise of the affected system, including unauthorized code execution, data manipulation, and denial of service. The vulnerability affects all installations of Tennis Club up to version 1.2.3. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable component to mitigate risk.