A critical deserialization vulnerability in the ThemeREX Pizza House plugin enables remote attackers to perform object injection, potentially leading to full system compromise.

The vulnerability involves the deserialization of untrusted data, which can be leveraged to perform object injection. The attack vector is unauthenticated, allowing remote malicious actors to execute arbitrary code or manipulate application logic.

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it can lead to unauthorized code execution and complete takeover of the affected web server. Given the CVSS score of 9.8, this flaw represents a critical threat that could result in total data loss, unauthorized access to sensitive customer information, and significant reputational damage.

Immediate Action: Identify all instances of the Pizza House plugin and update to the latest available version provided by the vendor.

Proactive Monitoring: Monitor server logs for suspicious serialized strings or unusual activity originating from the web application's input fields.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious serialized objects and suspicious HTTP request patterns.

Public Exploit Available: Unknown

This vulnerability is classified as critical and requires immediate attention due to the high risk of remote code execution. Security teams should prioritize patching affected WordPress installations and perform a thorough audit of the server environment to ensure no unauthorized persistence mechanisms have been established.