ThemeREX Convex WordPress theme: PHP Object Injection via untrusted data
Summary
The Convex WordPress theme by ThemeREX Group contains a deserialization flaw (CWE-502) that allows PHP object injection. According to the CNA, all versions up to and including 1.16.0 are affected. An unauthenticated remote attacker can send crafted input to a public site, which may lead to manipulated server-side processing and, depending on available gadget chains on the site, possible remote code execution.
Affected
- Convex WordPress theme, all versions up to and including 1.16.0 (per Patchstack and the CNA)
- Affected sites are WordPress sites running this theme
Fixed in
Unknown. No vendor-confirmed fixed version was found. Check the ThemeForest changelog and the Patchstack entry for the exact fixed version, which must be newer than 1.16.0.
Workaround
- No vendor-published workaround found.
- Patchstack has issued a mitigation rule (virtual patch) for this vulnerability; confirm coverage with your provider.
- Restrict public access where possible, for example through a WAF.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in KEV. No evidence of exploitation in the wild found.
- No public proof of concept found in searches; this is not conclusive.
- Third-party sites describe possible RCE via gadget chains, not confirmed by CNA, NVD or vendor.
- EPSS 0.00322 (Vulners aggregation).
Our recommendation
- Inventory all WordPress sites using the Convex theme and check the installed version.
- Prioritise public sites and update to a confirmed fixed version, or apply a virtual patch if no fix is available.
- Until patched, review sites for unknown admin users, unexpected files and changed content, and keep verified backups.
- Monitor for the vendor fix and any public proof of concept.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-93943 app.opencve.io
- Vulners CVELIST:CVE-2026-93943 vulners.com
- Vulners RAPID7 EPSS data vulners.com
- ThemeForest Convex theme themeforest.net
- ThemeREX Convex theme page themerex.net
- TheHackerWire CVE-2026-93943 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:52.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.