Travesia WordPress theme: PHP object injection
Summary
The Travesia WordPress theme, versions up to and including 1.1.16, contains a PHP object injection flaw caused by deserialization of untrusted data. An unauthenticated attacker can send crafted input to the website, which can manipulate how the site processes data and, depending on the PHP gadget chains available, lead to command execution on the server. Internet-facing travel and tour-operator websites are the most exposed, and no confirmed vendor fix is known.
Affected
- Travesia WordPress theme from 0 up to and including 1.1.16 (CNA record by Patchstack)
Fixed in
Unknown. No vendor-confirmed fixed version found. Do not assume that any version is fixed until the vendor or Patchstack confirms it.
Workaround
- No vendor-published workaround.
- If the theme is not needed, deactivate and remove it.
- Restrict access to the WordPress admin area.
- Ask your WAF or security plugin provider whether a rule for this vulnerability is available.
Exploitation
- No public proof of concept and no reports of exploitation in the wild found at the time of research.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV. EPSS about 0.003.
- Patchstack rates it as high priority and expects exploitation, so treat affected sites as at risk.
Our recommendation
- Check whether any website uses the Travesia theme and which version is installed.
- Treat version 1.1.16 and older as vulnerable and take a backup before any change.
- Contact the vendor for a confirmed fixed version and apply it as soon as it is available.
- Until then, deactivate or remove the theme where possible, restrict admin access and monitor the site for suspicious activity.
- Recheck NVD and CISA KEV in a few days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for Travesia 1.1.16 patchstack.com
- OpenCVE: CVE-2026-93929 app.opencve.io
- VulDB: CVE-2026-93929 vuldb.com
- Vulners CVElist: CVE-2026-93929 vulners.com
- Strix AI: CVE-2026-93929 www.strix.ai
- ThemeForest: Travesia theme (vendor changelog) themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:54.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.