CVE-2026-93932: WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
Affected Software
1 affected component
ThemeREX Group Smart Casa<=1.0.12
Event History
Oct 10, 2026
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is rated network-accessible with low attack complexity and requires no privileges or user interaction. An unauthenticated remote attacker could exploit it if a vulnerable Smart Casa installation exposes the affected deserialization path.
2
Which versions are affected?
Smart Casa versions through 1.0.12 are affected. The earliest affected version is not specified.
3
What is the potential impact?
The issue is rated critical with high impacts to confidentiality, integrity, and availability. Successful exploitation could allow PHP object injection through deserialization of untrusted data.