ThemeREX Let's Play CWE-502 Deserialization Bug CVE-2026-93935 Critical to v1.1.15
A critical deserialization flaw in ThemeREX Let's Play versions through 1.1.15 enables object injection attacks, posing severe risks to affected installations.
Key points
- The vulnerability affects ThemeREX Group Let's Play up to version 1.1.15.
- National Vulnerability Database rates CVE-2026-93935 as critical with a 9.8 CVSS score.
- The flaw is classified as CWE-502, involving deserialization of untrusted data.
ThemeREX Group has a critical security issue in its Let's Play plugin. The flaw allows attackers to inject objects through deserialization of untrusted data.
What happened
The National Vulnerability Database recorded CVE-2026-93935 as a critical vulnerability in ThemeREX Group software. The issue stems from improper handling of serialized data within the Let's Play plugin. Attackers can exploit this weakness to inject arbitrary objects into the application.
This deserialization flaw affects all versions of Let's Play from its initial release through version 1.1.15. The National Vulnerability Database assigns the issue a CVSS score of 9.8. This high score reflects the potential for significant system compromise. The weakness is categorized under CWE-502, which covers deserialization of untrusted data.
Why it matters
Developers using the Let's Play plugin face significant exposure to remote attacks. Object injection can lead to unauthorized code execution on vulnerable servers. The critical severity rating indicates that exploitation is likely straightforward for threat actors.
Systems running version 1.1.15 or earlier are directly affected by this issue. The lack of input validation during deserialization creates a direct path for attackers. This compromise can bypass standard application security controls. The impact extends to any environment where the plugin processes external data inputs.
What to watch
- Monitor server logs for unusual deserialization errors or unexpected object creation.
- Check for unauthorized changes in application behavior or new file uploads.
- Review network traffic for anomalous data patterns from plugin endpoints.
- Verify the plugin version against the affected range of versions through 1.1.15.
Background: CVSS score
CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.
Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment
What to do and how to stay safe: ThemeREX
- Audit your installation to confirm the current version of the Let's Play plugin.
- Restrict network access to plugin endpoints until a secure version is available.
- Enable detailed logging to detect potential object injection attempts in real time.
- Prepare an incident response plan for potential exploitation of this vulnerability.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Let's Play are affected by CVE-2026-93935?
All versions of ThemeREX Group Let's Play from the initial release through version 1.1.15 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-93935 with a critical CVSS score of 9.8.
What type of weakness is this vulnerability?
This is a deserialization of untrusted data vulnerability, classified as CWE-502, which allows object injection.
