Description
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
Published: 2026-10-10
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from unsafe deserialization of data supplied by users, allowing an attacker to instantiate arbitrary PHP objects within the Hogwords WordPress theme; this flaw can lead to remote code execution on the affected site and is classified as CWE-502, deserialization of untrusted data.

Affected Systems

ThemeREX Group's Hogwords theme, versions 1.2.7 and earlier, are affected. Any installation of Hogwords up to and including 1.2.7 is vulnerable, regardless of minor patch releases. Versions newer than 1.2.7 are presumed not to contain the flaw.

Risk and Exploitability

With a CVSS score of 9.8, this issue is considered extremely severe. No EPSS data is available, and the vulnerability is not currently listed in the CISA KEV catalogue. Attackers would need to supply malicious serialized data that is processed by the theme; the vector is most likely through web requests accepted by the theme, such as form submissions or cookie data. This defect can be exploited by anyone who can influence the data that the theme deserializes, potentially allowing arbitrary code execution on the server.

Generated by OpenCVE AI on October 10, 2026 at 08:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Hogwords theme to a version newer than 1.2.7.
  • If an upgrade is not immediately possible, restrict or remove any functionality that accepts serialized data and enforce strict validation or sanitization on user inputs.
  • Review the theme code for unsafe unserialize calls and replace them with secure deserialization functions or disable the affected feature until a patch is released.

Generated by OpenCVE AI on October 10, 2026 at 08:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Themerex Group
Themerex Group hogwords
Wordpress-extensions
Wordpress-extensions hogwords
Vendors & Products Themerex Group
Themerex Group hogwords
Wordpress-extensions
Wordpress-extensions hogwords

Sat, 10 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
Title WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Themerex Group Hogwords
Wordpress-extensions Hogwords
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T12:13:39.189Z

Reserved: 2026-09-19T00:23:25.965Z

Link: CVE-2026-93938

cve-icon Vulnrichment

Updated: 2026-10-11T12:06:08.129Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T08:17:06.310

Modified: 2026-10-13T13:28:15.717

Link: CVE-2026-93938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T12:24:52Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data