Description

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T19:17:43.337Z",
  "pubdate": "2026-09-11T19:17:43.337Z",
  "executiveSummary": "The ThemeREX Addons plugin for WordPress, in versions prior to 2.45.0, contains a critical unauthenticated PHP Object Injection vulnerability.\nThis security flaw arises from insecure deserialization of user-supplied data, allowing unauthenticated remote attackers to inject malicious PHP objects into the application context.\nThe impact of this vulnerability is severe, potentially leading to Remote Code Execution (RCE), unauthorized file access, or arbitrary data manipulation within the host environment.\nSuccessful exploitation does not require authentication, meaning any remote attacker can interact with the vulnerable endpoint to trigger the deserialization process.\nBy leveraging a POP (Property Oriented Programming) chain within the plugin or the underlying WordPress environment, an attacker can achieve code execution under the context of the web server user.\nThe vulnerability represents a high risk to the confidentiality, integrity, and availability of affected WordPress installations. Organizations utilizing ThemeREX Addons must prioritize updating to version 2.45.0 or higher to mitigate this exposure.",
  "technicalDetails": "The vulnerability resides within the ThemeREX Addons plugin, specifically in its handling of serialized input data. The root cause is the usage of the PHP 'unserialize()' function on unsanitized user-supplied input.\nIn the affected versions (< 2.45.0), the plugin processes incoming requests that contain serialized data without performing adequate validation or integrity checks. When the application passes this untrusted input to the 'unserialize()' function, it reconstructs the object based on the attacker's payload.\nAttack flow involves an unauthenticated actor sending a crafted HTTP request containing a serialized PHP object to a specific vulnerable endpoint within the plugin. The attacker designs this object payload to trigger magic methods such as '__destruct()', '__wakeup()', or '__toString()' existing within available classes defined in the plugin or the wider WordPress installation.\nBy carefully selecting gadgets (classes available in the current execution scope that perform sensitive operations when invoked), the attacker constructs a POP chain. As the PHP engine deserializes the object, it automatically invokes these magic methods. If the chain reaches a sink—such as 'eval()', 'system()', 'file_put_contents()', or similar execution-capable functions—the attacker achieves arbitrary code execution.\nThis vulnerability is particularly dangerous because it bypasses the need for administrative or subscriber-level access. The exposure is network-based, reachable by any remote actor capable of sending requests to the WordPress instance. Furthermore, since the object injection occurs during the object instantiation phase, the attacker can influence the state of the object, potentially leading to privilege escalation, sensitive information disclosure, or the bypass of security logic implemented within the plugin.\nThe persistence of this vulnerability is tied to the lack of input sanitization or the absence of a whitelist-based deserialization approach. As long as the vulnerable function remains reachable and takes user input, the application remains susceptible to memory corruption or malicious command injection."
}