A critical deserialization vulnerability in the ThemeREX Good Energy theme allows unauthenticated attackers to perform Object Injection, potentially leading to remote code execution.

The theme fails to properly handle the deserialization of untrusted data. This flaw permits an unauthenticated attacker to inject malicious objects, which can lead to arbitrary code execution or other destructive outcomes.

Object injection vulnerabilities are high-severity flaws that can lead to full server compromise, unauthorized code execution, and persistent backdoors. Given the CVSS score of 9.8, the business impact is extreme, potentially resulting in complete loss of control over the affected web server.

Immediate Action: Update the ThemeREX Good Energy theme to the latest version beyond 1.7.7 as soon as possible.

Proactive Monitoring: Monitor server activity for unexpected process execution or unauthorized file modifications in the web directory.

Compensating Controls: Utilize a WAF to inspect incoming serialized data streams and block payloads containing known malicious object patterns.

Public Exploit Available: Not specified

Given the critical nature of remote code execution vulnerabilities, this update should be prioritized above standard maintenance. Organizations must ensure that the theme is updated and verify that no unauthorized web shells have been uploaded prior to the patch.