Camelia WordPress theme: PHP object injection via deserialization

Summary

The WordPress theme Camelia up to and including version 1.2.15 contains a deserialization flaw (CWE-502) that allows PHP object injection. Successful exploitation can let an attacker manipulate how the site processes data and run harmful actions on the server. According to the research notes, the attack path is unauthenticated, but this still needs confirmation from the Patchstack advisory; exploitation also depends on gadget chains in installed plugins and the theme.

Affected

• Camelia WordPress theme from n/a through 1.2.15 (CVE record)
• Patchstack lists the vulnerable versions as <= 1.2.15

Fixed in

Unknown. No official patch is confirmed for this CVE. Version 1.2.16 is the latest vendor release, but it is not confirmed to contain this fix.

Workaround

• No vendor workaround confirmed.
• Restrict access to the site where possible.
• If the theme is not in active use, switch to another theme and remove the Camelia files.
• Check whether a Patchstack virtual patch or WAF rule is available for this entry.

Exploitation

• No evidence of exploitation in the wild found.
• Not listed in CISA KEV.
• No public proof of concept found.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• EPSS about 0.003 (low).

Our recommendation

• Inventory all installations of the theme folder "camelia", including client sites, and check the installed version.
• Treat versions up to 1.2.15 as vulnerable until the vendor or Patchstack confirms a fix.
• Ask ThemeREX/AxiomThemes or Patchstack for a patched build; update or replace the theme if no fix is confirmed.
• Prioritise internet-facing sites; apply a virtual patch or WAF rule if available.
• Monitor for a vendor advisory, a Patchstack virtual patch, a PoC or a KEV listing.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack vulnerability advisory patchstack.com
• OpenCVE CVE-2026-93944 app.opencve.io
• Vulners CVE-2026-93944 (cvelist) vulners.com
• ThemeForest Camelia theme page themeforest.net
• Patchstack PHP Object Injection academy patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:53.