CVE-2026-93943

CriticalCVSS 9.8

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

Deserialization of Untrusted Data vulnerability in the Convex theme by ThemeREX Group allows Object Injection. This issue affects Convex from n/a through 1.16.0.

Risk Assessment

An attacker could inject malicious objects, potentially leading to remote code execution or full site compromise on WordPress.

Recommendation

Update the Convex theme to the latest version that fixes this vulnerability, or temporarily disable the theme if no update is available.

Other vulnerabilities in Convex

CVE-2026-97691Medium
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS