CVE-2026-66483: CWE-502 Deserialization of Untrusted Data in ThemeREX Education Center

This vulnerability, identified as CWE-502, involves deserialization of untrusted data in ThemeREX Education Center software versions up to and including 3.6.12. An attacker can exploit this flaw without authentication by injecting malicious PHP objects, potentially leading to remote code execution or other severe impacts. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation can result in complete system compromise, including unauthorized code execution, data disclosure, and service disruption. Since the vulnerability is exploitable without authentication and requires no user interaction, it poses a high risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to PHP object injection attempts.