A critical deserialization vulnerability in the ThemeREX Pizza House WordPress theme allows unauthenticated attackers to execute arbitrary code on the host server.

This is a deserialization of untrusted data (CWE-502) vulnerability. The flaw allows unauthenticated, remote attackers to inject malicious PHP objects, which can be leveraged to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation. Given the CVSS score of 9.8, the business impact is severe, including potential data exfiltration, complete system compromise, and the ability to pivot into the underlying server infrastructure.

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and remove the Pizza House theme from their environment until a security update is provided by the vendor.

Proactive Monitoring: Review web server and WordPress application logs for suspicious serialized strings or unusual post requests directed at theme-specific files.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts or common PHP object injection payloads.

Public Exploit Available: Unknown

Due to the lack of a vendor-supplied patch and the critical severity of the vulnerability, immediate removal of the theme is the only effective mitigation. Organizations should prioritize migrating to a secure, actively maintained theme to eliminate this risk entirely.