ThemeREX Royal Event: PHP Object Injection via untrusted data deserialization

Summary

The ThemeREX Royal Event WordPress theme, versions up to and including 2.0 (lower bound unknown), deserializes untrusted data, which allows PHP Object Injection. An unauthenticated remote attacker can exploit this without user interaction, which may allow manipulation of server-side processing and, depending on the gadget chains available in the site's plugins, remote code execution or data compromise. CVSS 3.1 is 9.8 (Critical) per Patchstack; VulDB scores it 7.3. No exploitation in the wild is known at the time of writing.

Affected

• ThemeREX Royal Event theme, from n/a through 2.0 (per CVE record and Patchstack)
• Version numbering is unclear: the ThemeForest changelog lists 2.10.0 and 2.11.0, and it is unknown whether '2.0' refers to the same numbering scheme.

Fixed in

Unknown. No fixed version has been confirmed by the vendor or Patchstack.

Workaround

Unknown. No vendor workaround is documented.

Exploitation

• No evidence of exploitation in the wild; not listed in CISA KEV at time of writing.
• No public exploit or PoC indexed at time of writing.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• Patchstack expects exploitation and describes it as high priority.

Our recommendation

• Check whether Royal Event is installed and active on any site, including inactive copies.
• Update to the latest ThemeForest version and review its changelog for a security fix for this issue.
• If the theme is unused, deactivate and remove it.
• Restrict access to admin and AJAX endpoints where possible; use a web application firewall or Patchstack virtual patch if available.
• Create a backup before making changes.
• Monitor the Patchstack advisory and NVD for a confirmed fix and re-check in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry vuldb.com
• OffSeq threat radar radar.offseq.com
• ThemeForest Royal Event item page themeforest.net
• ThemeREX Royal Event documentation doc.themerex.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:21.