CVE-2026-93943: WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability
Published Oct 10, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
Affected Software
1 affected component
ThemeREX Group Convex<=1.16.0
Event History
Oct 10, 2026
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely over the network without authentication or user interaction. An attacker can potentially affect confidentiality, integrity, and availability.
2
Which Convex versions are affected?
Convex versions through 1.16.0 are affected. The available information does not identify a fixed version.
3
Is a default installation affected?
The provided information does not state whether a particular configuration or feature must be enabled. It identifies deserialization of untrusted data in the Convex theme as the affected condition.