Axiomthemes Veto: PHP Object Injection via deserialization of untrusted data
Summary
The WordPress theme Veto by Axiomthemes contains a deserialization flaw (CWE-502) that allows PHP Object Injection in all versions up to and including 1.6.0. An unauthenticated remote attacker can manipulate data processed by the site, which may enable harmful actions on the server, depending on whether a usable gadget chain exists in the theme, other plugins or WordPress core. The CVSS score of 9.8 partly reflects Patchstack's policy of assigning maximum impact to such reports without a proven gadget chain.
Affected
- Veto WordPress theme by Axiomthemes, versions up to and including 1.6.0
- Note: sources also refer to the component as a plugin; confirm which component is installed
Fixed in
- No official patch confirmed by the sources.
- Patchstack's CNA guidance: upgrade to any release above 1.6.0 or replace the theme.
- Unverified candidate: vendor changelog entry for version 1.8.0 (03.03.2026) mentions a possible Object Injection fix; it does not reference this CVE and must be verified. Newer versions exist (e.g. 1.9.0); check the latest release.
Workaround
- No vendor-specific workaround found.
- Deactivate or replace the Veto theme on internet-facing sites.
- Restrict access to the WordPress admin area.
- If a WAF or virtual-patching service is used, ask whether it covers this CVE.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
- EPSS 0.0032 (low predicted exploitation probability).
- No known exploitation and no public proof of concept found at the time of research.
- Patchstack describes the vulnerability as high priority and expects exploitation.
Our recommendation
- Identify all WordPress sites using Veto, including staging copies.
- Update to the latest vendor version or replace the theme, and verify that the update contains a fix.
- Deactivate Veto until a fixed version is confirmed on sites that cannot be updated.
- Review backups, logs and WordPress files for unexpected changes since 8 Oct 2026.
- Monitor the Patchstack and WPScan advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress Veto theme <= 1.6.0 PHP Object Injection patchstack.com
- OpenCVE CVE-2026-93927 app.opencve.io
- CVELIST CVE-2026-93927 (Vulners) vulners.com
- VulDB CVE-2026-93927 vuldb.com
- Veto theme on ThemeForest (vendor changelog) themeforest.net
- Patchstack academy: PHP Object Injection patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:53.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.