ThemeREX Edema theme: PHP object injection via untrusted deserialization

Summary

The WordPress theme Edema up to and including version 1.2.2.2 deserializes untrusted data (CWE-502), which allows PHP object injection. According to the CVSS vector, an unauthenticated remote attacker can exploit this over the network without user interaction, which may lead to a high impact on confidentiality, integrity and availability of the website server. Patchstack rates the issue as high priority and expects exploitation, but exploitation is currently not confirmed.

Affected

• Edema WordPress theme from n/a through 1.2.2.2 (vendor: ThemeREX Group)
• Sold via ThemeForest

Fixed in

Unknown. No fixed version confirmed by the advisory. The ThemeForest changelog lists version 1.2.2.2 (25.06.2025) with the note "Theme vulnerability", which is unclear and must be checked.

Workaround

Unknown. No workaround found in the sources reviewed. General measures: restrict access to the WordPress admin area, keep WordPress core and plugins updated, and remove the theme on sites that do not use it.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total
• Patchstack expects exploitation and rates the flaw as high priority
• EPSS about 0.3%
• No public proof of concept or in-the-wild exploitation found in the reviewed sources; not on the KEV catalogue according to a third-party tracker (not verified directly)

Our recommendation

• Check the installed Edema version on every site and compare it with the latest version on ThemeForest
• Treat version 1.2.2.2 and lower as vulnerable until the vendor or Patchstack confirms a fix
• Remove the theme where it is not used; restrict admin access
• Check the ThemeREX Addons plugin below 2.45.0 (CVE-2026-62105), which has a related unauthenticated PHP object injection flaw
• Monitor the Patchstack advisory and vendor updates and apply fixes promptly

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-93941 app.opencve.io
• Vulners CVELIST CVE-2026-93941 vulners.com
• ThemeForest Edema item page themeforest.net
• ThemeREX Edema product page themerex.net
• CVE-2026-62105 related ThemeREX Addons flaw cvefeed.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:51.