Axiomthemes Balance WordPress theme: PHP Object Injection via unsafe deserialization
Summary
The Axiomthemes Balance WordPress theme, versions up to and including 1.12.0, deserializes untrusted data (CWE-502), which allows PHP object injection. According to the Patchstack advisory, an attacker can manipulate how the site processes data to run harmful actions on the server. A third-party analysis describes possible remote code execution or site takeover, but this is not confirmed by the vendor; the required privileges are described as none in the vector, but the authentication requirement is not explicitly confirmed.
Affected
- Axiomthemes Balance WordPress theme, versions from n/a through 1.12.0
- Lower bound of the affected range: unknown
- Note: other vendors also sell themes named Balance; confirm the Axiomthemes product before acting
Fixed in
Unknown. No confirmed fixed version from the vendor or Patchstack. Positive Technologies implies a fix in 1.12.1, which is not verified.
Workaround
No vendor-documented workaround found.
- Remove the theme if it is unused
- Restrict access to admin and vulnerable endpoints where possible
- Keep backups and logs for review
- Patchstack reports a mitigation rule may be available for its customers
Exploitation
- No public exploit found at the time of research
- No evidence of exploitation in the wild; not listed in KEV
- CISA SSVC: exploitation none, automatable yes, technical impact total
- EPSS about 0.3%
- Patchstack rates the priority as high; the situation may change quickly as the CVE is recent
Our recommendation
- Identify all sites using the Axiomthemes Balance theme and check their version
- Treat any public-facing installation as high priority
- Update to a version confirmed to contain the fix from ThemeForest or the vendor once verified
- If no fix is available, remove or replace the theme and restrict access
- Check other Axiomthemes products for similar advisories
- Monitor NVD, KEV and exploit sources for changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress Balance theme PHP Object Injection patchstack.com
- Positive Technologies PT-2026-109589 vulners.com
- VulDB CVE-2026-93945 vuldb.com
- OpenCVE CVE-2026-93945 app.opencve.io
- ThemeForest Balance theme (vendor page) themeforest.net
- PSIRT CVE-2026-93945 psirt.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:47.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.