CriticalVulnerability

CVE-2026-93929

PHP object injection in ThemeREX Travesia

Published Oct 10, 2026 · Updated 10 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

7 mentions · peak 7 in a dayToday

CVSS9.8Critical · v3.1

EPSS0.32%24th percentile

CISA KEVNoNot listed

In the wildNoneNot observed

Vendor: ThemeREX Group

IdentifiersCVE-2026-93929CWE-502 · Deserialization of Untrusted Data

CVE-2026-93929 is an untrusted-data deserialization vulnerability in the ThemeREX Group Travesia WordPress theme. It affects versions through 1.1.16, with no starting version specified. Deserialization of untrusted data allows PHP object injection. The vulnerable function and input entry point are not identified.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows PHP object injection. Specific downstream consequences, such as code execution, data disclosure, data modification, or service disruption, are not established.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ThemeREX GroupTravesiaapplication

External references

References

MITRE CVEcve.org · CVE-2026-93929 NVDnvd.nist.gov/vuln/detail/CVE-2026-93929 MITRE CWE · CWE-502Deserialization of Untrusted Data patchstack.compatchstack.com/database/wordpress/theme/travesia/vulnerability/wordpress-travesia-theme-1-1-16-php-object-injection-vulnerability?_s_id=cve

Activity feed

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

ghsa syntheticNews · Oct 10, 2026GHSA-qr7g-mmgw-6fp4An untrusted-data deserialization vulnerability in ThemeREX Group Travesia allows object injection. Versions through 1.1.16 are affected; the earliest affected version is unspecified. The content does not describe exploitation prerequisites or further impacts.Read more ↗cvefeed high severityNews · Oct 10, 2026CVE-2026-93929 - WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerabilityAn untrusted-data deserialization vulnerability (CWE-502) in the ThemeREX Group Travesia WordPress theme, affecting versions through 1.1.16, allows PHP object injection. The reported CVSS v3.1 vector indicates network-accessible, low-complexity exploitation without privileges or user interaction, with high confidentiality, integrity, and availability impacts. The record was received on October 10, 2026.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery observed campaign linking this CVE to a named adversary.

Associated malwareMalware families riding this exploit, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity5Community discussion across Reddit, Mastodon, and other social sources.

CriticalVulnerability

CVE-2026-93929

PHP object injection in ThemeREX Travesia

Published Oct 10, 2026 · Updated 10 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

7 mentions · peak 7 in a dayToday

CVSS9.8Critical · v3.1

EPSS0.32%24th percentile

CISA KEVNoNot listed

In the wildNoneNot observed

Vendor: ThemeREX Group

IdentifiersCVE-2026-93929CWE-502 · Deserialization of Untrusted Data

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows PHP object injection. Specific downstream consequences, such as code execution, data disclosure, data modification, or service disruption, are not established.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ThemeREX GroupTravesiaapplication

External references

References

Activity feed

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery observed campaign linking this CVE to a named adversary.

Associated malwareMalware families riding this exploit, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity5Community discussion across Reddit, Mastodon, and other social sources.