CVE-2026-93944 Overview
CVE-2026-93944 is a PHP Object Injection vulnerability in the ThemeREX Camelia WordPress theme. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions of Camelia up to and including 1.2.15. An unauthenticated remote attacker can send crafted serialized payloads to trigger object instantiation within the theme's PHP runtime. When combined with a suitable gadget chain, exploitation can lead to remote code execution, data theft, or full site compromise.
Critical Impact
Unauthenticated network-based object injection in the Camelia WordPress theme enables remote code execution, data manipulation, and complete loss of confidentiality, integrity, and availability of affected WordPress sites.
Affected Products
- ThemeREX Camelia WordPress theme versions through 1.2.15
- WordPress installations with the Camelia theme active
- Any site using Camelia components that process serialized input
Discovery Timeline
- 2026-10-10 - CVE-2026-93944 published to the National Vulnerability Database
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-93944
Vulnerability Analysis
The Camelia theme passes attacker-controlled input to a PHP deserialization function without validating the source or structure of the data. PHP's unserialize() reconstructs objects based on the serialized byte stream, invoking magic methods such as __wakeup(), __destruct(), and __toString() during the process. When those magic methods interact with filesystem, database, or dynamic code execution APIs, an attacker can chain existing classes into a gadget that performs arbitrary actions.
Because the vulnerable code path is reachable over the network without authentication or user interaction, exploitation does not require a valid WordPress account. The impact extends beyond the theme itself: any class loaded in the WordPress process, including those shipped by core, plugins, or other themes, can contribute to a gadget chain.
Root Cause
The root cause is unsafe use of PHP deserialization on data that originates from an untrusted source. The theme does not enforce type restrictions, allowed-class allowlists via the allowed_classes option of unserialize(), or integrity checks such as HMAC validation before processing the input. This matches the pattern described in CWE-502: Deserialization of Untrusted Data.
Attack Vector
Exploitation is performed over HTTP against a WordPress site running a vulnerable Camelia theme. An attacker submits a serialized PHP object payload through a request parameter that the theme deserializes. If a suitable gadget chain is available in the WordPress environment, the deserialization triggers code execution, file writes, or database manipulation during normal request handling.
Technical details are available in the Patchstack WordPress Vulnerability Report.
Detection Methods for CVE-2026-93944
Indicators of Compromise
- HTTP request bodies or query parameters containing serialized PHP patterns such as O:, a:, s:, or __PHP_Incomplete_Class sent to WordPress endpoints handled by the Camelia theme.
- Unexpected PHP files, webshells, or modifications under wp-content/themes/camelia/ or wp-content/uploads/.
- New or modified WordPress administrator accounts and unexpected wp_options or wp_users entries following inbound requests to theme endpoints.
- PHP error log entries referencing unserialize(), __wakeup, or __destruct from Camelia theme files.
Detection Strategies
- Inspect web server access logs for POST and GET requests to Camelia theme paths carrying serialized object markers.
- Deploy web application firewall rules that block requests containing PHP serialized object patterns in parameters not expected to carry them.
- Monitor file integrity on the wp-content/themes/camelia/ directory and the WordPress core files for unauthorized changes.
Monitoring Recommendations
- Centralize WordPress, PHP-FPM, and web server logs in a SIEM and alert on anomalous POST payload sizes to theme endpoints.
- Track outbound connections from the web server to detect command-and-control activity initiated by deserialization payloads.
- Alert on new PHP file creation in web-accessible directories and on unexpected scheduled tasks registered through wp_cron.
How to Mitigate CVE-2026-93944
Immediate Actions Required
- Identify all WordPress sites running the Camelia theme and inventory the installed versions.
- Update Camelia to a patched release once the vendor publishes a fixed version above 1.2.15.
- If no patched version is available, deactivate and remove the Camelia theme until a fix is released.
- Rotate WordPress administrator credentials, API keys, and database passwords on any site that may have processed malicious serialized input.
Patch Information
As of the NVD publication date, the vulnerability affects Camelia versions through 1.2.15. Monitor the Patchstack advisory for Camelia and the ThemeREX vendor channels for a patched release and apply it immediately once available.
Workarounds
- Place the affected site behind a web application firewall with rules that block PHP serialized payloads in request parameters.
- Restrict access to WordPress endpoints handled by the Camelia theme using network access controls or authentication gateways.
- Disable or remove unused plugins and themes to shrink the pool of classes available for gadget chains.
- Run WordPress with least-privilege filesystem permissions so that the web server user cannot modify theme or core PHP files.
# Configuration example: temporarily disable the Camelia theme using WP-CLI
wp theme list --status=active
wp theme activate twentytwentyfour
wp theme delete camelia
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
