Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through… (CVE-2026-93942)

The vulnerability identified as CVE-2026-93942 involves deserialization of untrusted data in the ThemeREX Group Dwell theme, which allows an attacker to perform object injection. This can lead to severe consequences including full compromise of the affected system. The affected versions include all releases up to 1.16.0. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can result in complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or apply any vendor-recommended mitigations once published.