Key points
- The National Vulnerability Database assigned CVE-2026-93943 to the deserialization flaw in the Convex plugin.
- The vulnerability allows object injection, which the NVD classifies as a Critical severity issue with a CVSS score of 9.8.
- All versions of the ThemeREX Group Convex plugin from its inception through version 1.16.0 are affected by this security issue.
The National Vulnerability Database published a record for CVE-2026-93943, identifying a severe security flaw in the ThemeREX Group Convex plugin for WordPress. The issue involves the deserialization of untrusted data, a common vector for object injection attacks. Security operations teams managing WordPress environments should immediately audit their plugin versions to determine if they are running an affected build of the Convex tool.
In plain English
Object injection occurs when an application accepts data that it then converts into an object without proper validation. In this specific case, the Convex plugin processes data in a way that allows an attacker to inject malicious objects into the application’s memory. According to the NVD record, this weakness is classified under CWE-502, which denotes the deserialization of untrusted data. This type of flaw often leads to remote code execution, allowing attackers to take control of the server hosting the website.
The background
The vulnerability affects every version of the ThemeREX Group Convex plugin released up to and including version 1.16.0. The NVD record states that the issue exists "from n/a through 1.16.0," indicating that no version of the plugin is currently safe from this specific exploit. The flaw has been rated 9.8 on the CVSS scale, which places it in the Critical severity range. This high score reflects the ease with which an attacker can exploit the vulnerability and the severe impact on system integrity, availability, and confidentiality.
What changes now
Security administrators must treat this finding as an urgent priority. Because the flaw affects all versions through 1.16.0, any site using the plugin is potentially vulnerable. The immediate task is to verify the installed version of the Convex plugin across all managed WordPress installations. If a fix has not been confirmed by the vendor, teams should consider disabling or removing the plugin until a secure version is available. Monitoring server logs for unusual serialization activity can also help detect exploitation attempts while a permanent solution is sought.
What to do and how to stay safe: ThemeREX
- Audit all WordPress installations to identify if the ThemeREX Convex plugin is installed and check its version number.
- Disable the Convex plugin immediately if it is version 1.16.0 or older, and wait for a vendor update before re-enabling it.
- Review server access logs for signs of unauthorized object serialization or unusual data payloads targeting the plugin’s endpoints.
- Ensure that all other WordPress plugins and themes are updated to their latest versions to reduce the overall attack surface.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of the ThemeREX Convex plugin are vulnerable?
All versions of the Convex plugin from its initial release through version 1.16.0 are affected by CVE-2026-93943.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-93943 as Critical with a CVSS score of 9.8.
What type of attack does this vulnerability enable?
The flaw allows for object injection through the deserialization of untrusted data, classified as CWE-502.
