{"id":"CVE-2026-93933","published":"2026-10-10T08:17:05.680","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/rosalinda/vulnerability/wordpress-rosalinda-theme-1-2-4-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject malicious objects during deserialization, potentially leading to remote code execution or complete system compromise. The flaw occurs in ThemeREX Group's Rosalinda theme where untrusted data is deserialized without proper validation.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability affects the core deserialization process that can be triggered by any user with access to the affected system.","blast_radius":"If exploited, this critical vulnerability could allow attackers to execute arbitrary code on the target system, potentially leading to full compromise of the WordPress installation and underlying server resources.","remediation":"Upgrade to Rosalinda version 1.2.5 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","wordpress","rce","critical"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:44:53.930Z"}}