Critical Deserialization Flaw Found in ThemeREX Camelia Plugin Through Version 1.2.15

The National Vulnerability Database published a record for CVE-2026-93944, identifying a critical security flaw in the ThemeREX Group Camelia plugin. This vulnerability allows for the deserialization of untrusted data, creating a pathway for object injection attacks against affected WordPress installations.

According to the NVD record, the vulnerability carries a CVSS score of 9.8, placing it in the critical severity range. The underlying weakness is classified under CWE-502, which pertains to the deserialization of untrusted data. This specific type of flaw often enables attackers to execute arbitrary code or take control of a server if the application processes malicious data without proper validation.

Context and Background

The National Vulnerability Database describes the issue as allowing object injection through the deserialization of untrusted data. This mechanism typically occurs when an application accepts serialized objects from users and processes them without verifying their integrity or origin. Attackers can craft malicious serialized data that, when processed by the vulnerable application, executes unintended commands or alters system behavior.

ThemeREX Group develops Camelia, a widely used theme framework for WordPress. The framework powers numerous websites globally, making any security flaw within its core code significant for the broader web ecosystem. The NVD record specifies that the vulnerability exists in versions ranging from the earliest available release through version 1.2.15. This wide range of affected versions suggests that many installations may still be running vulnerable code if they have not recently updated.

Who Is Affected

The vulnerability affects all installations of the ThemeREX Group Camelia plugin that are running version 1.2.15 or earlier. According to the source material, the issue impacts versions from "n/a" through 1.2.15. This indicates that any site using the plugin prior to a potential fix released after this version is at risk. Website administrators who have not updated their theme frameworks since the release of version 1.2.15 should assume their systems are vulnerable to this specific object injection attack.

No vendor statement or patch release date is included in the provided source material. Consequently, it is not confirmed whether a fix has been distributed to users. Administrators must rely on monitoring vendor channels for official updates regarding this CVE. Until a confirmed patch is available, the exposure remains active for all affected installations.

What should you do?

Security professionals should immediately audit their WordPress environments to determine if the Camelia plugin is installed. If the plugin is present, administrators must check the version number against the affected range identified by the NVD. Sites running version 1.2.15 or older are currently vulnerable to object injection attacks via untrusted data deserialization.