{"id":"CVE-2026-93935","published":"2026-10-10T08:17:05.933","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/playhockey/vulnerability/wordpress-let-s-play-theme-1-1-15-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows untrusted data deserialization that can lead to object injection attacks, potentially enabling remote code execution or complete system compromise. The flaw affects the Let's Play playhockey plugin version 1.1.15 and earlier.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability occurs during deserialization of untrusted data from network requests.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to full system compromise and data exfiltration.","remediation":"Upgrade to version 1.1.16 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:45:03.060Z"}}