Is CVE-2026-93942 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93942 being exploited in the wild.

How severe is CVE-2026-93942?

Critical severity, with a CVSS score of 9.8, published 10 October 2026.

Which products and versions are affected?

ThemeREX Group Dwell through 1.16.0.

How is CVE-2026-93942 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93942?

Check whether you run ThemeREX Group Dwell at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93942: ThemeREX Group Dwell PHP object injection

CVE-2026-93942 · Severity: critical · CVSS 9.8 · Published 2026-10-10

Dwell is a WordPress theme used by website builders to create custom websites. An unauthenticated attacker can exploit a PHP object injection vulnerability to execute malicious code on the server, potentially compromising the entire website and gaining control over its data and functionality. This vulnerability affects all versions up to 1.16.0 and carries critical risk due to ease of exploitation and lack of authentication requirements.

Vendors: ThemeREX Group.

Quick answers

Is CVE-2026-93942 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93942 being exploited in the wild.
How severe is CVE-2026-93942?: Critical severity, with a CVSS score of 9.8, published 10 October 2026.
Which products and versions are affected?: ThemeREX Group Dwell through 1.16.0.
Is there a fix for CVE-2026-93942?: No fixed version is recorded yet. Until an official patch is available, apply a Web Application Firewall (WAF) mitigation rule to block object injection attacks, or disable the vulnerable theme and switch to an alternative theme. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93942 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93942?: Check whether you run ThemeREX Group Dwell at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Until an official patch is available, apply a Web Application Firewall (WAF) mitigation rule to block object injection attacks, or disable the vulnerable theme and switch to an alternative theme.

Technical details

The vulnerability is a PHP object injection flaw in the Dwell WordPress theme versions through 1.16.0 that allows unauthenticated remote attackers to manipulate data processing and execute arbitrary code on the server. The attack requires only network access and no user interaction. This deserialization flaw enables object injection attacks that can lead to remote code execution with full server privileges.

Affected products

ThemeREX Group Dwell through 1.16.0

Timeline

2026-10-10: disclosed
2026-02-28: reported

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.