This vulnerability in ThemeREX Tennis Club plugin versions up to 1.2.3 involves unsafe deserialization of untrusted data, enabling object injection attacks. Such vulnerabilities can allow remote attackers to execute arbitrary code or cause denial of service. The CVSS 3.1 score of 9.8 reflects its critical impact with full confidentiality, integrity, and availability compromise possible without authentication or user interaction. No patch or official remediation details are currently provided.

Successful exploitation could lead to remote code execution, data compromise, and service disruption on affected installations of the Tennis Club plugin. Given the critical CVSS score and the nature of object injection, the impact is severe, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.