Tantra Theme CVE-2026-93930

Exploitation requires reaching a code path in the Tantra theme (versions up to and including 2.9.0) that passes attacker-controlled input to PHP unserialize(), and - to achieve the high impact claimed - requires a usable POP gadget chain present in the theme, an installed plugin, or WordPress core. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed, implying a publicly reachable entry point, though the advisory description does not name the specific parameter or endpoint. LIMITING FACTORS: the site must actually run the Tantra theme; practical code execution depends on the availability of a gadget chain, so impact may be reduced to limited object injection where no chain exists.

This is a CWE-502 PHP Object Injection flaw in the ThemeREX 'Tantra' WordPress theme, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning the vendor/reporter (Patchstack) models it as remotely reachable over the network, low complexity, requiring no privileges and no user interaction, with high confidentiality, integrity and availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 9.8 reflects theoretical worst-case impact, not demonstrated exploitation. A critical caveat for deserialization/object-injection bugs: real impact (RCE, file write, SQLi) depends on a usable POP gadget chain being present in the theme or a co-installed plugin/WordPress core; without a confirmed chain, the C:H/I:H/A:H rating may overstate practical severity. Net: treat as a high-priority patch candidate for any site actually running this theme because the metrics suggest unauthenticated remote exploitation, but note the real-world urgency is tempered by a niche product footprint and the absence of any exploitation or POC signal.

A remote, unauthenticated attacker submits a crafted serialized PHP payload to a theme endpoint or parameter that is passed to unserialize(), instantiating attacker-chosen objects. If a suitable POP gadget chain exists in the theme, a plugin, or WordPress core, object instantiation triggers magic methods (__wakeup/__destruct) leading to code execution, file manipulation, or data compromise. No public exploit code was provided in the input, so weaponization would require the attacker to identify a working gadget chain.