CVE-2026-93942

Deferred Deferred - Pending Action

Deserialization of Untrusted Data in Dwell

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93942

EUVD

EUVD-2026-96188

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeREX	Group	Dwell 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is a PHP Object Injection vulnerability in the WordPress Dwell Theme (versions up to 1.16.0) where improper handling of user input allows attackers to manipulate data processing and execute harmful actions on the server without authentication. It has a CVSS score of 9.8, indicating high severity and likelihood of exploitation.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the Dwell theme versions up to 1.16.0. Inspect WordPress installations for the theme directory and compare version numbers. Use commands like 'grep -r "Dwell" /path/to/wordpress/wp-content/themes/' or check the theme's style.css file for version details.

Impact Analysis

Attackers could exploit this to execute arbitrary code on your server, potentially taking control of your website, stealing data, or launching further attacks. Since no official patch exists, unpatched sites remain at high risk of compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately apply Patchstack's temporary mitigation rule to block attacks until an official patch is released. Consider updating the theme or contacting your hosting provider or developer for assistance. Since no official patch exists, these steps are critical to reduce exposure.

Hi! I’m here to help you understand CVE-2026-93942. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70