Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a… (CVE-2026-93933)

CVE-2026-93933 is a deserialization of untrusted data vulnerability in the ThemeREX Group Rosalinda theme. This flaw allows an attacker to perform object injection by exploiting unsafe deserialization processes. The vulnerability affects Rosalinda versions from an unspecified start through 1.2.4. It has a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to full compromise of the affected system, including unauthorized code execution, data manipulation, and denial of service. The high CVSS score indicates critical impact on confidentiality, integrity, and availability of the system running the vulnerable theme.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor for vendor updates and apply any official patches once released. Until then, avoid using affected versions or implement additional controls to mitigate unsafe deserialization risks if possible.