ThemeREX Hogwords: PHP object injection via untrusted deserialization

Summary

The WordPress theme Hogwords up to and including version 1.2.7 deserializes untrusted data without proper validation (CWE-502). An unauthenticated remote attacker can send crafted serialized data to the website, which may allow PHP object injection and manipulation of server-side processing. Exploitability depends on other installed plugins or libraries that provide usable classes; no public exploit or in-the-wild exploitation has been reported.

Affected

• ThemeREX Group Hogwords WordPress theme, versions up to and including 1.2.7
• Lower bound of affected versions: unspecified (n/a)

Fixed in

• Unknown. No fixed version or vendor patch confirmed at the time of research.

Workaround

• Deactivate or replace the theme if no fix is available.
• Apply a web application firewall or virtual patch, for example a Patchstack mitigation rule, if the site is covered.
• Restrict or monitor access to the site and review logs for unusual serialized data in requests.

Exploitation

• No known exploitation in the wild.
• No public proof of concept found.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV.

Our recommendation

• Check whether any website uses the Hogwords theme and identify its version.
• If the theme is in use, treat the site as high priority: deactivate or replace it, or apply a virtual patch until a fix is confirmed.
• Monitor the Patchstack advisory and the ThemeREX changelog for a fixed version and apply it promptly.
• Review web server logs for suspicious serialized data in requests and check for signs of compromise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-93938 patchstack.com
• OpenCVE CVE-2026-93938 app.opencve.io
• VulDB CVE-2026-93938 vuldb.com
• Vulners CVE list entry CVE-2026-93938 vulners.com
• ThemeREX Hogwords theme page themerex.net
• ThemeREX Updater plugin (Pluginizer) pluginizer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:50.