CVE-2026-93942

Summary

A critical deserialization vulnerability exists in Dwell theme that allows untrusted data to be deserialized, leading to potential object injection attacks. This flaw can be exploited by remote attackers without authentication.

Exploitability

Exploitation is relatively straightforward as it requires only sending malicious serialized data to the vulnerable endpoint, with no additional authentication or complex preconditions needed.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise across all installations running versions 1.0 through 1.16.0.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.16.1 or later to remediate this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.