{"id":"CVE-2026-119526","kind":"vulnerability","aliases":["CVE-2026-119526"],"related":[],"title":"ThemeREX Royal Event theme: untrusted data deserialization lets attackers inject objects","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.\n\nThis issue affects Royal Event: from n/a through 2.0.","summary":"ThemeREX Royal Event, a WordPress theme or plugin, deserializes untrusted input, which allows object injection. The sources do not say what an attacker can do after injecting objects, though object injection flaws often lead to code execution.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ThemeREX Royal Event","fixed":[],"affected":"<= 2.0","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["other","php-object-injection","royal-event","themerex","themerex-royal-event","wordpress","wordpress-theme"],"not_affected_if":["not-installed","theme-not-active"],"how_to_check":"In WordPress admin go to Appearance > Themes, or look for wp-content/themes/royal-event (folder name unconfirmed) and read Version in style.css. Version 2.0 or earlier is in the affected range.","fix":null,"status":"open","published_at":"2026-10-30T19:18:20+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:25:45+00:00","updated_at":"2026-10-30T19:26:38+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T19:25:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ThemeREX Royal Event theme: untrusted data deserialization lets attackers inject objects","impact":"high","summary":"ThemeREX Royal Event, a WordPress theme or plugin, deserializes untrusted input, which allows object injection. The sources do not say what an attacker can do after injecting objects, though object injection flaws often lead to code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","themerex-royal-event"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; object injection may allow code execution on the server","analyst_note":"Confirm the affected product type, the vulnerable entry point and whether a patched version exists; the NVD entry alone gives no fix or detail.","how_to_check":"- Check whether the Royal Event theme or plugin is installed on the site (unknown for the exact install path in the sources)\n- Compare the installed version against `2.0` (the affected range ends at 2.0)","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Sites running the ThemeREX Royal Event product at version 2.0 or earlier are in the listed range. The sources do not say which configuration or request path is exposed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000661,"input_tokens":4085,"output_tokens":504,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected product type, the vulnerable entry point and whether a patched version exists; the NVD entry alone gives no fix or detail.","search":"'-119526':14A,17A '-2026':13A,16A '2.0':95C 'affect':89C 'allow':50B,84C 'attack':9A,60B 'code':73B 'cve':12A,15A 'data':6A,78C 'deseri':7A,46B,75C 'event':3A,20A,28B,33B,40B,83C,91C 'execut':74B 'flaw':69B 'inject':10A,25B,52B,64B,68B,86C 'input':48B 'issu':88C 'lead':71B 'let':8A 'n/a':93C 'object':11A,24B,51B,65B,67B,85C 'often':70B 'php':23B 'php-object-inject':22B 'plugin':45B 'royal':2A,19A,27B,32B,39B,82C,90C 'royal-ev':26B 'say':57B 'sourc':54B 'theme':4A,37B,43B 'themerex':1A,18A,29B,31B,38B,81C 'themerex-royal-ev':30B 'though':66B 'untrust':5A,47B,77C 'vulner':79C 'wordpress':34B,36B,42B 'wordpress-them':35B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the premium ThemeREX Royal Event theme at version 2.0 or earlier installed. The CVSS vector says no login is needed over the network, but the advisory names no endpoint or parameter, and real impact such as code execution depends on a usable gadget chain in the site's plugins or core. Sites without this theme can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119526","severity":null,"published_at":"2026-10-30T19:18:20+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119526:1193","url":null,"severity":null,"published_at":"2026-10-30T19:26:38+00:00","modified_at":"2026-10-30T19:26:38+00:00","first_seen_at":"2026-10-30T19:26:38+00:00","fetched_at":"2026-10-30T19:26:38+00:00","note":"No Patchstack/vendor advisory found for Royal Event (patchstack DB page 404); only NVD (CNA Patchstack, CVSS 9.8 N/AC:L/PR:N, <=2.0) and ThemeREX docs (premium theme v2.0.0, so it is a theme, not a plugin). Fix unknown; no exploitation or PoC found. Sibling ThemeREX theme CVEs same day pattern."}],"documents":[{"id":25493,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119526","title":"NVD CVE-2026-119526","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":25494,"url":"https://doc.themerex.net/royal-event/","title":"Royal Event documentation v2.0.0 (ThemeREX)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}