{"id":"CVE-2026-93937","published":"2026-10-10T08:17:06.187","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/hygia/vulnerability/wordpress-hygia-theme-1-21-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows untrusted data deserialization that can lead to arbitrary object injection, potentially enabling remote code execution or complete system compromise. The flaw affects Hygia version 1.21.0 and earlier.","exploitability":"Exploitation is relatively straightforward as it requires only sending malicious serialized data to the vulnerable endpoint, with no authentication required for exploitation.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected system, potentially leading to full system compromise and data exfiltration across all systems using Hygia version 1.21.0 or earlier.","remediation":"Upgrade to Hygia version 1.21.1 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:45:12.721Z"}}