{"id":"CVE-2026-93932","published":"2026-10-10T08:17:05.547","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Smart Casa plugin suffers from a deserialization vulnerability that allows untrusted data to be injected into objects during processing, potentially leading to remote code execution or complete system compromise.","exploitability":"Exploitation requires sending malicious serialized data to the plugin's deserialization endpoint, which can be done remotely without authentication, making it relatively easy to exploit with a simple HTTP request.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to full compromise including data theft, backdoor installation, or further lateral movement within the network.","remediation":"Upgrade to version 1.0.13 or later to remediate the deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:44:48.825Z"}}