Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-93935: WordPress Let’s Play theme can run unwanted code
CVE-2026-93935 · published today
Summary
The Let’s Play theme for WordPress (versions up to 1.1.15) can be tricked into processing crafted data, which may let an attacker execute code on your site. This could let a malicious user take control of the website or steal information. Update the theme to a newer version or remove it if you cannot apply the update.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| themerex group | let's play | <= 1.1.15 |
Original advisory text
WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published10 Oct 2026
Updated10 Oct 2026
First seen10 Oct 2026
Track software like this
Free during beta