CVE-2026-93931: WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
Affected Software
1 affected component
ThemeREX Group Smash<=1.12.0
Event History
Oct 10, 2026
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
ThemeREX Group Smash is affected through version 1.12.0. The available data does not identify a fixed version.
2
Can this be exploited remotely without authentication or user interaction?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. It also indicates high potential impact to confidentiality, integrity, and availability.