Axiomthemes Veto CVE-2026-93927

The vulnerable code path is Veto's handling of untrusted serialized data passed to PHP unserialize() (CWE-502 Object Injection), present in all versions up to and including 1.6.0. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and the attack is network-reachable against a default install of the theme. The critical LIMITING factor is that Object Injection alone does not guarantee code execution or data impact - a usable POP gadget chain must be present in the theme, an installed plugin, or WordPress core for meaningful impact; without such a chain, practical impact may be substantially lower than the 9.8 rating suggests. Exploitation also requires the site to be running the Veto theme (a niche product), and no fixed version is stated in the available data.

The input signals are strong on paper but thin in corroboration. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) describes a remote, unauthenticated, low-complexity vulnerability with full confidentiality, integrity, and availability impact - the profile of a readily weaponizable flaw. However, no EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation probability and in-the-wild activity cannot be confirmed: no public exploit identified at time of analysis. A key nuance is that CWE-502 PHP Object Injection rarely delivers the full C:H/I:H/A:H impact on its own - realistic impact depends on a usable POP (property-oriented programming) gadget chain being reachable in the theme, installed plugins, or WordPress core, which is a condition outside the attacker's direct control. This makes the 9.8 score plausibly optimistic for many real deployments. No SSVC decision data (exploitation status, automatable, technical impact) was provided. Net: treat as a high-priority patch candidate because of the unauthenticated network vector and critical theoretical impact, but the absence of EPSS/KEV/POC and the gadget-chain dependency mean this is more likely a 'high-CVSS, situational-real-risk' issue than confirmed mass exploitation. Verify affected-version and impact claims against the Patchstack advisory.

A remote, unauthenticated attacker sends a crafted request to a Veto theme endpoint that passes attacker-controlled input to an unsafe PHP unserialize() call. If a suitable POP gadget chain exists in the theme, active plugins, or WordPress core, the injected object triggers that chain on instantiation, leading to outcomes such as arbitrary file operations, SQL injection, or code execution. No public exploit code was identified at time of analysis, and successful exploitation is contingent on an available gadget chain.