Themerex Group

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-112846	PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.	CRITICAL	9.8	0.6%	50	No patch
CVE-2026-112851	PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.	CRITICAL	9.8	0.6%	50	No patch
CVE-2026-112856	PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.	CRITICAL	9.8	0.6%	50	No patch
CVE-2026-112859	PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.	CRITICAL	9.8	0.6%	50	No patch
CVE-2026-93936	PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93937	PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93938	PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93940	PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93941	PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-62045	Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-62046	PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93929	PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93930	PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93931	ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.	CRITICAL	9.8	0.3%	49	No patch
CVE-2026-93932	PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.	CRITICAL	9.8	0.3%	49	No patch

CVE-2026-112846

PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.

CRITICAL

9.8

0.6%

50

No patch

CVE-2026-112851

PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.

CRITICAL

9.8

0.6%

50

No patch

CVE-2026-112856

PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.

CRITICAL

9.8

0.6%

50

No patch

CVE-2026-112859

PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.

CRITICAL

9.8

0.6%

50

No patch

CVE-2026-93936

PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93937

PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93938

PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93940

PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93941

PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-62045

Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-62046

PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93929

PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93930

PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93931

ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.

CRITICAL

9.8

0.3%

49

No patch

CVE-2026-93932

PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.

CRITICAL

9.8

0.3%

49

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (29)

Top Risky CVEs