Key points
- The vulnerability is CVE-2026-93931, rated Critical with a CVSS score of 9.8.
- It affects ThemeREX Group Smash versions from the initial release through 1.12.0.
- The flaw involves CWE-502, allowing deserialization of untrusted data via object injection.
Security researchers and the National Vulnerability Database have identified a severe flaw in the ThemeREX Smash plugin. The issue, tracked as CVE-2026-93931, allows attackers to inject objects through untrusted data. This deserialization vulnerability enables remote code execution on websites running the affected software. The National Vulnerability Database rates the severity as Critical.
By the numbers
- 9.8 is the CVSS score assigned to CVE-2026-93931, indicating a Critical severity level.
- 1.12.0 is the latest version of ThemeREX Smash known to be affected by the flaw.
- CWE-502 is the Common Weakness Enumeration identifier for the deserialization of untrusted data.
What the figures mean
A CVSS score of 9.8 represents the highest tier of severity, according to the National Vulnerability Database. This rating suggests that an attacker can exploit the flaw remotely without needing authentication. The impact is total control over the compromised server. Deserialization flaws like CWE-502 are dangerous because they allow code to execute automatically when data is processed.
What to watch
ThemeREX Smash is a popular plugin for building landing pages and websites. The vulnerability exists in all versions up to and including 1.12.0. The National Vulnerability Database record notes that versions prior to the current one are also at risk. Object injection is the specific mechanism used to exploit this deserialization issue. No official patch has been confirmed by the vendor in the source material.
What to do and how to stay safe: ThemeREX
- Audit your plugins to see if ThemeREX Smash version 1.12.0 or older is installed on any servers.
- Isolate affected web servers from public internet access until a vendor update is released and verified.
- Monitor server logs for unusual process creation or outbound connections that could indicate exploitation.
- Review firewall rules to block unauthorized access to administrative endpoints associated with the plugin.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-93931?
It is a critical deserialization vulnerability in the ThemeREX Smash plugin that allows object injection and remote code execution.
Which versions of ThemeREX Smash are affected?
All versions of the Smash plugin from the initial release through version 1.12.0 are affected by this flaw.
Is there a fix available?
The source material does not confirm that a patch or fix has been released by the vendor yet.
