CVE-2026-93938: Deserialization of Untrusted Data in ThemeREX Group Hogwords

This vulnerability in ThemeREX Group Hogwords (versions >=0 <=1.2.7) arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. Such flaws can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and potential remote code execution. The vulnerability affects all users running vulnerable versions of Hogwords, potentially allowing attackers to execute arbitrary code remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor ThemeREX Group advisories for updates and apply patches once available. Until then, consider mitigating exposure by restricting access to the vulnerable application and applying any recommended temporary mitigations from the vendor.