Deserialization of Untrusted Data in Convex

Executive Summary

CVE-2026-93943 is a Deserialization of Untrusted Data vulnerability in the ThemeREX Group Convex theme. It allows Object Injection, meaning attackers can manipulate data processing on the server to execute harmful actions. The flaw exists in versions up to 1.16.0 and requires no authentication to exploit.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the Convex WordPress theme version 1.16.0 or earlier. Inspect your WordPress installation for the theme files and verify the version in the style.css file. No direct commands are provided in the context, but you can use WordPress admin panel or file system checks to identify the theme version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute harmful actions on your website, even if it has low traffic. It poses a significant risk as it can be exploited in mass campaigns targeting thousands of sites. Immediate action is advised to prevent potential damage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unpatched systems risk exposing sensitive data, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply Patchstack's temporary mitigation rule to block attacks until an official patch is released. Update the Convex theme to the latest version if available, or seek help from a hosting provider or web developer. Consider disabling the theme temporarily if no patch exists.

Useful 0 Not Useful 0