CVE-2026-93935

Deferred Deferred - Pending Action

Deserialization of Untrusted Data in Let's Play playhockey

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93935

EUVD

EUVD-2026-96194

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeREX	Group	Let's Play 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is a PHP Object Injection vulnerability in the WordPress Let's Play Theme (versions 1.1.15 and below) that allows attackers to inject malicious objects during deserialization. This can lead to unauthorized data manipulation and server-side code execution without requiring authentication.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Let's Play theme version 1.1.15 or below. Inspect theme files for suspicious deserialization functions or untrusted data handling. Use security plugins like Patchstack to scan for PHP Object Injection attempts.

Impact Analysis

Attackers can exploit this flaw to take over websites, steal sensitive data, or perform harmful actions on the server. Since no authentication is needed, it poses a high risk for mass exploitation campaigns targeting thousands of sites.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection. Organizations may face legal penalties, reputational damage, and loss of customer trust if exploited.

Mitigation Strategies

Immediately apply Patchstack's mitigation rule to block attacks. Update the theme if an official patch is released. If no patch exists, consider disabling the theme or seeking help from a developer. Use automated vulnerability mitigation tools like Patchstack for protection.

Hi! I’m here to help you understand CVE-2026-93935. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70