IPharm WordPress theme: PHP Object Injection via untrusted data
Summary
The WordPress theme IPharm (ThemeREX Group, versions up to and including 1.2.4) contains an unsafe deserialization flaw that allows PHP object injection. According to Patchstack, the flaw can be triggered without a login over the network, and an attacker may manipulate how the site processes data to run harmful actions on the server. The theme is used for online pharmacy and medical shops, so a compromise could also expose customer and health-related data.
Affected
- IPharm theme versions up to and including 1.2.4
- Lower bound of affected versions not published (NVD: 'from n/a')
Fixed in
Unknown. No vendor advisory or confirmed fixed version was found. Version 1.2.5 (changelog dated 13.03.2026) is not confirmed to fix this CVE.
Workaround
- No confirmed workaround from the vendor.
- Patchstack reports a mitigation rule that blocks attacks until an official patch is available (requires a Patchstack subscription).
- Restrict access to admin and sensitive endpoints.
- Place a web application firewall in front of the site.
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- Patchstack rates the issue as high priority and expects exploitation.
- No public proof of concept or in-the-wild exploitation known.
- Not listed in CISA KEV (per Strix). EPSS about 0.003.
Our recommendation
- Identify whether IPharm is installed and which exact version is active.
- If version 1.2.4 or older is in use, plan an update or replacement and confirm with Patchstack or the vendor that the new version fixes this CVE.
- If the theme is unused, remove it.
- Check other ThemeREX themes in use, as similar CVEs were published in the same batch.
- Monitor for vendor advisories, unexpected file changes and changes in EPSS or KEV status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress IPharm theme <= 1.2.4 - PHP Object Injection patchstack.com
- OpenCVE: CVE-2026-93936 app.opencve.io
- ThemeForest: IPharm theme listing and changelog themeforest.net
- Strix: CVE-2026-93936 www.strix.ai
- Vulners (Rapid7): CVE-2026-93936 vulners.com
- WPScan: related IPharm entry wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:47.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.