CVE-2026-93945

Deferred Deferred - Pending Action

Deserialization of Untrusted Data in Axiomthemes Balance

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93945

EUVD

EUVD-2026-96185

Affected Vendors & Products

Vendor	Product	Version / Range
Axiomthemes	Balance	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-93945 is a PHP Object Injection vulnerability in the WordPress Balance Theme versions up to 1.12.0. It allows attackers to inject malicious objects during deserialization, potentially leading to unauthorized data manipulation or server control. The flaw is unauthenticated and has a critical CVSS score of 9.8.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the vulnerable WordPress Balance Theme (versions up to 1.12.0). Inspect your WordPress installation for the theme in the /wp-content/themes/balance/ directory. Look for signs of unauthorized code execution or suspicious activity in server logs. Patchstack provides a temporary mitigation rule to block attacks.

Impact Analysis

This vulnerability can allow attackers to execute harmful actions on your server without authentication. It may lead to complete site compromise, data theft, or further malware deployment. Since it is actively exploited in mass campaigns, unpatched sites are at high risk of compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR and HIPAA requirements for data protection. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive data.

Mitigation Strategies

Immediately apply Patchstack's temporary mitigation rule to block attacks. Update the Balance theme to the latest version if available. If no patch exists, seek assistance from a hosting provider or developer. Consider using Patchstack's automated mitigation and security solutions for protection.

Hi! I’m here to help you understand CVE-2026-93945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70