# CVE-2026-93938: ThemeREX Hogwords PHP object injection

Source: https://junglewise.ai/threats/cve-2026-93938-deserialization-of-untrusted-data-vulnerability-in-themerex-group  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-93938 · Severity: critical · CVSS 9.8 · Published 2026-10-10

Hogwords is a WordPress theme used to build and manage websites. An unauthenticated attacker can exploit a PHP object injection vulnerability to execute arbitrary code on the server, potentially leading to complete website compromise, data theft, or malware installation.

Vendors: [ThemeREX Group](https://junglewise.ai/threats/vendors/themerex-group).

## Quick answers

**Is CVE-2026-93938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93938 being exploited in the wild.

**How severe is CVE-2026-93938?** Critical severity, with a CVSS score of 9.8, published 10 October 2026.

**Which products and versions are affected?** ThemeREX Group Hogwords through 1.2.7.

**Is there a fix for CVE-2026-93938?** No fixed version is recorded yet. Apply a web application firewall or security plugin rule to block exploitation attempts until an official patch is released. No official patch is currently available according to Patchstack. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93938 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93938?** Check whether you run ThemeREX Group Hogwords at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply a web application firewall or security plugin rule to block exploitation attempts until an official patch is released. No official patch is currently available according to Patchstack.

## Technical details

A PHP object injection vulnerability in Hogwords theme versions up to 1.2.7 allows unauthenticated remote attackers to manipulate data processing on the server. The vulnerability stems from unsafe deserialization of untrusted user input. Successful exploitation enables arbitrary code execution with server-level privileges.

## Affected products

- ThemeREX Group Hogwords through 1.2.7

## Timeline

- 2026-10-08: disclosed
- 2026-10-10: advisory

## References

- [https://themeforest.net/](https://themeforest.net/)
- [https://patchstack.com/database/wordpress/theme/hogwords/vulnerability/wordpress-hogwords-theme-1-2-7-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/hogwords/vulnerability/wordpress-hogwords-theme-1-2-7-php-object-injection-vulnerability?_s_id=cve)