CVE-2026-78529: CWE-502 Deserialization of Untrusted Data in ThemeREX Alliance

This vulnerability, identified as CWE-502, involves unsafe deserialization of untrusted data in ThemeREX Alliance software versions up to and including 3.11. An attacker can exploit this flaw remotely without authentication to perform PHP Object Injection, potentially leading to arbitrary code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in complete system compromise, including unauthorized access, data manipulation, and service disruption. Because the vulnerability is exploitable remotely without authentication or user interaction, it poses a critical risk to affected systems.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the vulnerable application and monitor for suspicious activity related to PHP object injection attempts.