{"id":"CVE-2026-93940","published":"2026-10-10T08:17:06.433","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/greeny/vulnerability/wordpress-greeny-theme-2-10-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to inject malicious objects during deserialization, potentially leading to remote code execution or complete system compromise. The flaw exists in the Greeny theme's handling of untrusted data.","exploitability":"Exploitation is relatively straightforward with no authentication required, though it may need a specific payload format that aligns with the target's PHP object structure.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected WordPress site, potentially leading to full system compromise and data exfiltration.","remediation":"Upgrade to version 2.10.1 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:45:21.941Z"}}