CVE-2026-93938

Deferred Deferred - Pending Action

ThemeREX Hogwords Object Injection Vulnerability

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93938

EUVD

EUVD-2026-96191

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeREX	Group	Hogwords 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-93938 is a Deserialization of Untrusted Data vulnerability in the ThemeREX Group Hogwords theme. It allows Object Injection, meaning attackers can manipulate data processing to execute harmful server-side actions. The flaw affects versions up to 1.2.7 and has a critical CVSS score of 9.8.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the Hogwords theme version 1.2.7 or below. Inspect WordPress installations for the theme directory and review version details in the style.css file. No specific commands are provided in the context, but monitoring for unusual server-side activity or unauthorized data processing may indicate exploitation.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute harmful actions on your server, potentially leading to data breaches, site defacement, or complete system compromise. It is actively exploited in mass campaigns targeting websites of all sizes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately apply Patchstack's temporary mitigation rule to block attacks. Update the Hogwords theme to the latest version if available. If no patch exists, seek assistance from a hosting provider or developer to address the vulnerability. Consider using Patchstack's automated mitigation and security solutions for protection.

Hi! I’m here to help you understand CVE-2026-93938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70