CVE-2026-93941: WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
Affected Software
1 affected component
ThemeREX Group Edema<=1.2.2.2
Event History
Oct 10, 2026
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be treated as affected?
Edema installations running any version through 1.2.2.2 are affected. The provided data does not identify an unaffected fixed version.
2
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the potential security impact?
The issue is rated critical with a CVSS score of 9.8 and indicates high impact to confidentiality, integrity, and availability.