Live › vulnerability › CVE-2026-119526
ThemeREX Royal Event, a WordPress theme or plugin, deserializes untrusted input, which allows object injection. The sources do not say what an attacker can do after injecting objects, though object injection flaws often lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Any WordPress site with the premium ThemeREX Royal Event theme at version 2.0 or earlier installed. The CVSS vector says no login is needed over the network, but the advisory names no endpoint or parameter, and real impact such as code execution depends on a usable gadget chain in the site's plugins or core. Sites without this theme can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ThemeREX Royal Event | wordpress-theme | <= 2.0 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects Royal Event: from n/a through 2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-119526")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.