The ThemeREX Classter WordPress theme is vulnerable to PHP Object Injection, which could allow an unauthenticated attacker to execute arbitrary code.

This is a deserialization of untrusted data (CWE-502) vulnerability. The flaw allows unauthenticated remote attackers to inject malicious serialized PHP objects, potentially leading to remote code execution or other unauthorized actions.

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve remote code execution, effectively granting full control over the affected WordPress installation. Given the CVSS score of 9.8, this poses a critical risk to data confidentiality, integrity, and availability, potentially leading to site defacement, data theft, or the propagation of further malware within the network.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and remove the Classter theme from the WordPress environment until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious serialized strings or unusual activity originating from unknown IP addresses targeting the theme's directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and malicious serialized payloads.

Public Exploit Available: Unknown.

The critical nature of this vulnerability necessitates immediate action. Because no patch exists, the only effective mitigation is to discontinue the use of the affected theme. Security teams should prioritize identifying all instances of this software and removing it to prevent potential compromise.