CVE-2026-93935: WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

Q: Which installations should be treated as affected?

ThemeREX Group Let's Play installations running version 1.1.15 or earlier should be treated as affected. The affected version range begins at an unspecified earlier version.

Q: Does an attacker need an account or user interaction to exploit this issue?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the potential impact if exploitation succeeds?

The CVSS vector rates confidentiality, integrity, and availability impact as high. The reported severity is critical, with a 9.8 score.

Published Oct 10, 2026

Updated

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

Affected Software

1 affected component

ThemeREX Group Let's Play<=1.1.15

Event History

Oct 10, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be treated as affected?

ThemeREX Group Let's Play installations running version 1.1.15 or earlier should be treated as affected. The affected version range begins at an unspecified earlier version.

Does an attacker need an account or user interaction to exploit this issue?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the potential impact if exploitation succeeds?