CVE-2026-93944

Summary

This vulnerability allows untrusted data deserialization in Camelia theme, enabling remote code execution through object injection attacks that can be triggered by any authenticated user.

Exploitability

Exploitation is relatively straightforward requiring only a single authenticated request to a vulnerable endpoint with no additional preconditions.

Blast radius

The impact could be severe across all installations using Camelia theme version 1.2.15 or earlier, potentially allowing attackers to execute arbitrary code on affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Camelia version 1.2.16 or later to remediate this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.