What is the CVSS score of CVE-2026-93929?

CVE-2026-93929 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-93929?

Within 24 hours, inventory all WordPress sites using the ThemeREX Travesia theme version 1.1.16 or earlier, and if the theme is not essential, deactivate and remove it; otherwise, deploy virtual patching via your Web Application Firewall (WAF) to block PHP object injection and untrusted deserialization attempts, and restrict administrative access. Within 7 days, if the theme remains active, conduct a security review of all installed plugins and themes to identify potential POP gadget chains, enable comprehensive logging and monitoring for exploitation attempts, and ensure backups are current. Within 30 days, continue to monitor the vendor's advisory for a patch release and apply it immediately once available; if no patch emerges, consider migrating to an alternative maintained theme and implement additional isolation controls such as file integrity monitoring and least-privilege database accounts.

ThemeREX Travesia CVE-2026-93929

EUVD-2026-96200 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-10-10 Patchstack

GHSA-qr7g-mmgw-6fp4

WordPress Deserialization Wordpress Theme Themerex Group Travesia

9.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site using Travesia theme
Delivery

Craft malicious serialized PHP payload
Exploit

Submit payload to vulnerable deserialization endpoint
Execution

Object injection instantiates attacker-controlled objects
Impact

POP gadget chain executes code or file operations

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The affected product is the ThemeREX Travesia WordPress theme, versions up to and including 1.1.16; the site must have this theme installed and active. Exploitation requires reaching a PHP unserialize() call with attacker-controlled input (the object injection sink). The practical impact (code execution vs. benign) is gated by the presence of a usable POP gadget chain in the theme, WordPress core, or another installed plugin - without a reachable gadget, object injection alone may yield limited effect. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required to trigger the deserialization.
Impact	Signals are partially conflicting and incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8 as assigned by Patchstack) paints this as a maximally severe, remote, unauthenticated flaw. However, no EPSS score, no CISA KEV listing, and no public exploit (POC) were provided - so there is no evidence of active exploitation; status is 'no public exploit identified at time of analysis.' SSVC inputs (exploitation status, automatable, technical impact) were not supplied. A key caveat specific to CWE-502 PHP Object Injection: the raw deserialization flaw only translates into C:H/I:H/A:H impact when a usable POP gadget chain is present in the theme, WordPress core, or an installed plugin - the 9.8 assumes a reachable chain exists, which is not confirmed in the input. Net: this is a credible high-priority issue for sites running the Travesia theme, but the 9.8 should be read as a worst-case ceiling, not confirmed widespread risk, given the absent EPSS/KEV/POC signals and gadget-chain dependency.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted request to a WordPress site running the Travesia theme (≤1.1.16) containing a malicious serialized PHP payload that reaches an unserialize() call. If a suitable POP gadget chain is available, the injected object triggers unintended method calls during deserialization, potentially leading to remote code execution, file operations, or data compromise. No public exploit code was identified in the provided data.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 10, 2026

PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.

RemediationAI

No vendor-released patch identified at time of analysis. Site administrators should check the ThemeREX vendor site and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/travesia/vulnerability/wordpress-travesia-theme-1-1-16-php-object-injection-vulnerability?_s_id=cve) for updates. If the theme is not essential, deactivate and remove it to eliminate the vulnerability. If it must remain active, consider implementing a web application firewall (WAF) rule to block serialized object patterns (e.g., 'O:' followed by a class name) in request parameters, though this may cause false positives for legitimate serialized data. Additionally, ensure WordPress core and all plugins/themes are up to date to reduce the availability of POP gadget chains that could turn object injection into code execution. Monitor for suspicious activity, as no public exploit is currently known but the vulnerability is severe.

Affected VersionsENISA

Travesia 0 ≤1.1.16

Affected Packages

euvd travesia no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a PHP object injection (CWE-502: Deserialization of Untrusted Data) in the ThemeREX Travesia WordPress theme. The theme passes attacker-controlled input to a PHP unserialize() call without adequate validation, allowing an attacker to inject arbitrary serialized PHP objects. This class of vulnerability can lead to code execution, file deletion, or other malicious actions, but the actual impact depends on the presence of a usable POP (Property-Oriented Programming) gadget chain within the theme, WordPress core, or other installed plugins. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable, unauthenticated vulnerability with high confidentiality, integrity, and availability impact. The CPE string cpe:2.3:a:themerex_group:travesia:*:*:*:*:*:*:*:* confirms that all versions of the Travesia theme are potentially affected, with the vendor advisory specifying versions through 1.1.16.

Know when Travesia gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated remote input reaches deserialization (AV:N/AC:L/PR:N/UI:N); C/I/A:H reflects worst-case object-injection-to-RCE assuming a reachable POP gadget chain exists.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

Executive ViewAI

Why It Matters

The ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) contains a critical PHP object injection vulnerability (CVE-2026-93929, CVSS 9.8) that could allow remote attackers to achieve arbitrary code execution on affected websites. Organizations using this theme for public-facing sites face potential full site compromise, data theft, and service disruption, which could lead to reputational harm, regulatory penalties, and operational downtime. No public exploit identified at time of analysis, but leadership should prioritize immediate mitigation because no vendor patch is currently available.

Business Impact: Severe

Compensating Controls

Interim mitigations include deactivating or removing the vulnerable theme, deploying WAF rules to detect and block PHP object injection and deserialization attempts, restricting access to the affected site, monitoring for suspicious activity, and conducting a security review of installed components for potential POP gadget chains. No vendor-released patch identified at time of analysis.

Threat Intelligence Overview

EPSS Score

0.3%

Top 77% exploitable

Prevalence

Low

niche commercial WordPress theme, limited deployment footprint

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.