Quick answers
- Is CVE-2026-93931 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93931 being exploited in the wild.
- How severe is CVE-2026-93931?
- Critical severity, with a CVSS score of 9.8, published 10 October 2026.
- Which products and versions are affected?
- ThemeREX Group Smash through 1.12.0.
- Is there a fix for CVE-2026-93931?
- Yes: fixed in <UNKNOWN>. Until then: Patchstack has issued a mitigation rule to block attacks on the vulnerability; apply this mitigation while an official patch is being prepared. As an alternative, disable the Smash theme and switch to a patched alternative until an update is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93931 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-93931?
- Check whether you run ThemeREX Group Smash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: <UNKNOWN>
Patchstack has issued a mitigation rule to block attacks on the vulnerability; apply this mitigation while an official patch is being prepared. As an alternative, disable the Smash theme and switch to a patched alternative until an update is available.
Technical details
The Smash theme through version 1.12.0 is vulnerable to PHP object injection (CWE-502: Deserialization of Untrusted Data), allowing unauthenticated attackers to manipulate serialized objects and trigger arbitrary code execution on the server. The vulnerability is exploitable over the network without authentication or user interaction, presenting an immediate and severe risk to WordPress installations using this theme.
Affected products
- ThemeREX Group Smash through 1.12.0
Timeline
- 2026-10-08: disclosed
- 2026-10-10: advisory