CVE-2026-93933: WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
Affected Software
1 affected component
ThemeREX Group Rosalinda<=1.2.4
Event History
Oct 10, 2026
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Rosalinda theme installations running version 1.2.4 or earlier are affected. The available data does not identify a lower bound for affected versions.
2
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the potential impact of successful exploitation?
The CVSS vector rates confidentiality, integrity, and availability impact as high. Successful exploitation could therefore compromise data confidentiality, alter data, and disrupt service availability.