{"id":"CVE-2026-93936","published":"2026-10-10T08:17:06.060","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/ipharm/vulnerability/wordpress-ipharm-theme-1-2-4-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical deserialization vulnerability exists in IPharm versions through 1.2.4 that allows untrusted data to be deserialized, leading to potential object injection attacks. This flaw enables attackers to execute arbitrary code on the affected system.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability occurs during deserialization of untrusted input data.","blast_radius":"The impact could be severe across all installations running IPharm versions through 1.2.4, potentially allowing full system compromise and data exfiltration.","remediation":"Upgrade to version 1.2.5 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:45:07.743Z"}}