A critical unauthenticated PHP object injection flaw in the ThemeREX Abelle theme allows for potential remote code execution.

The software contains a deserialization of untrusted data vulnerability (CWE-502) that can be triggered by an unauthenticated attacker. This flaw permits the injection of malicious objects, which can lead to arbitrary code execution within the WordPress environment.

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it allows remote attackers to gain control over the affected application. This could result in the theft of database credentials, unauthorized access to user data, and the deployment of malware.

Immediate Action: Apply the latest security update released by ThemeREX for the Abelle theme. If an official update is not available, remove the theme from the production environment to eliminate the attack surface.

Proactive Monitoring: Audit server logs for requests that attempt to pass serialized data to theme functions. Monitor application performance for signs of unauthorized background processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter out malicious traffic that targets deserialization entry points.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability, immediate patching is required to prevent unauthorized system access. Security teams should verify that the theme is updated to the latest version and ensure that no malicious artifacts persist on the server.