---
id: "CVE-2026-119526"
kind: "vulnerability"
aliases: ["CVE-2026-119526"]
title: "ThemeREX Royal Event theme: untrusted data deserialization lets attackers inject objects"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ThemeREX Royal Event", "fixed": [], "affected": "<= 2.0", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["other", "php-object-injection", "royal-event", "themerex", "themerex-royal-event", "wordpress", "wordpress-theme"]
not_affected_if: ["not-installed", "theme-not-active"]
published_at: "2026-10-30T19:18:20+00:00"
first_seen_at: "2026-10-30T19:25:28+00:00"
updated_at: "2026-10-30T19:26:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119526", "first_seen_at": "2026-10-30T19:25:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:26:38+00:00"}]
---

# ThemeREX Royal Event theme: untrusted data deserialization lets attackers inject objects

ThemeREX Royal Event, a WordPress theme or plugin, deserializes untrusted input, which allows object injection. The sources do not say what an attacker can do after injecting objects, though object injection flaws often lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:ThemeREX Royal Event affected <= 2.0 fixed ?

## How to check

In WordPress admin go to Appearance > Themes, or look for wp-content/themes/royal-event (folder name unconfirmed) and read Version in style.css. Version 2.0 or earlier is in the affected range.

## Timeline

- 2026-10-30T19:25:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119526
- 2026-10-30T19:26:38+00:00 analyst — No Patchstack/vendor advisory found for Royal Event (patchstack DB page 404); only NVD (CNA Patchstack, CVSS 9.8 N/AC:L/PR:N, <=2.0) and ThemeREX docs (premium theme v2.0.0, so it is a theme, not a plugin). Fix unknown; no exploitation or PoC found. Sibling ThemeREX theme CVEs same day pattern.

## Documents

- [advisory] NVD CVE-2026-119526 https://nvd.nist.gov/vuln/detail/CVE-2026-119526
- [describes] Royal Event documentation v2.0.0 (ThemeREX) https://doc.themerex.net/royal-event/

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.

This issue affects Royal Event: from n/a through 2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_