CVE-2026-93930

Deferred Deferred - Pending Action

Deserialization of Untrusted Data in ThemeREX Tantra

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93930

EUVD

EUVD-2026-96199

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeREX	Group	Tantra 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-93930 is a PHP Object Injection vulnerability in the WordPress Tantra Theme versions 2.9.0 and below. It allows attackers to inject malicious objects during deserialization, potentially leading to remote code execution or other harmful actions on the server without authentication.

Detection Guidance

Check if the WordPress Tantra Theme version 2.9.0 or below is installed. Look for suspicious server activity like unexpected PHP object injections or unauthorized code execution. Use security plugins or tools to scan for known indicators of compromise related to this CVE.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on your server, take control of your website, steal sensitive data, or use your site to launch further attacks. It has a high CVSS score of 9.8, meaning it is highly dangerous and likely to be exploited widely.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. A breach may result in legal penalties, fines, and reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Apply the mitigation rule provided by Patchstack to block attacks. Update the theme if an official patch becomes available. Contact your hosting provider or developer for assistance. Consider using automated mitigation solutions from Patchstack for immediate protection.

Hi! I’m here to help you understand CVE-2026-93930. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70