ThemeREX Tantra theme: PHP object injection via unsafe deserialization
Summary
The WordPress theme Tantra up to and including version 2.9.0 deserializes untrusted data (CWE-502), which allows PHP object injection. According to the CNA record, the flaw is reachable over the network without authentication and can affect the confidentiality, integrity and availability of the site. Whether an attacker can actually run code depends on the classes present in the installed plugins and themes, which has not been verified.
Affected
- Tantra WordPress theme (ThemeREX Group, also listed by Patchstack as the Tantra theme)
- All versions up to and including 2.9.0
- Versions above 2.9.0 are not listed as affected by the CNA record, but no fixed version is named in any source.
Fixed in
Unknown.
- No source names a fixed version for this CVE.
- Later Tantra releases (for example 2.10.0 and 2.11.0) exist, but their release notes do not mention this CVE.
Workaround
- Unknown vendor workaround.
- Patchstack reports a mitigation rule that blocks attacks until an official patch is available; use it if you have a Patchstack or similar WAF with virtual patching.
- Restrict access to the WordPress admin area and keep WordPress core and all plugins up to date.
Exploitation
- No evidence of active exploitation found; CISA SSVC lists exploitation as none.
- Automatable: yes (CISA SSVC).
- No public proof of concept found.
- EPSS is about 0.003 (low).
- Patchstack classifies the issue as high priority and expects exploitation.
Our recommendation
- Check now whether any public website uses Tantra and which version is installed.
- Where Tantra is 2.9.0 or older, create a backup and plan an update, but only to a release confirmed by the vendor or Patchstack as fixed.
- Until a fix is confirmed, apply virtual patching via a WAF if available and restrict admin access.
- Check the installed ThemeREX Addons plugin version as well.
- Monitor logs for unusual requests and watch for an official vendor advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-93930 app.opencve.io
- ThemeForest Tantra listing themeforest.net
- Tantra documentation tantra.axiomthemes.com
- ThemeREX Addons vulnerability fix themerex.net
- Rapid7 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:54.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.