EUVD-2026-96185
GHSA-4236-v7g9-hpxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to theme endpoint
-
DeliveryDeliver malicious serialized PHP payload
-
ExploitTrigger unsafe unserialize() object injection
-
ExecutionInvoke POP gadget chain methods
-
PersistExecute attacker-controlled actions on server
-
ImpactCompromise site data and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the site to be running the Axiomthemes Balance WordPress theme at version 1.12.0 or earlier, and an attacker-controllable input must reach a PHP unserialize() call. The practical limiting factor is that PHP Object Injection yields meaningful impact (RCE, file write, SQLi) only when a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin - without such a gadget the injection may be inert. Per the supplied CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so the primary constraint is deployment of the affected theme/version plus gadget availability rather than access level. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a fully remote, unauthenticated, low-complexity flaw with total confidentiality, integrity, and availability impact - the maximal-risk profile. However, this is a PHP Object Injection / CWE-502 deserialization issue, and the realistic impact of such flaws depends on whether a usable POP (property-oriented programming) gadget chain is reachable in the theme, WordPress core, or co-installed plugins; the 9.8 score implicitly assumes a code-execution-grade gadget exists, which the source data does not confirm. No EPSS score, SSVC decision, KEV listing, or POC reference is present in the supplied intelligence, so exploitation probability and automatability cannot be quantified from the data. The only source is a single Patchstack advisory. Net assessment: treat as a high-priority patch candidate for any site running the Balance theme given the unauthenticated network vector, but the absence of exploitation signals (no KEV, no POC, no EPSS) means there is no evidence of active or widespread exploitation, and the real-world severity hinges on gadget-chain availability that is not verified here. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to a WordPress site running the Balance theme (≤1.12.0), supplying a malicious serialized PHP payload to an input that is passed to unserialize(). If a suitable POP gadget chain is present in the theme, core, or another plugin, the injected object triggers unintended method calls that can lead to file operations, SQL interaction, or remote code execution. No public exploit code is identified in the supplied data, and successful code execution depends on a reachable gadget chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
RemediationAI
No vendor-released patch or fixed version number is identified in the available data, so the first step is to track the Patchstack advisory at https://patchstack.com/database/wordpress/theme/balance/vulnerability/wordpress-balance-theme-1-12-0-php-object-injection-vulnerability?_s_id=cve and apply an Axiomthemes Balance update the moment a patched release above 1.12.0 is published - verify the changelog rather than assuming the next version is fixed. If the theme is not required for the site's current design, deactivating and deleting it removes the attack surface outright, at the cost of breaking any templates or customizations that depend on it. Where the theme must stay, reduce gadget availability by keeping WordPress core and all other plugins at current versions, since POI only escalates to RCE or file write when a compatible POP chain is loaded; understand this is risk reduction, not a fix, and it can be undone by any future plugin introducing a usable gadget. Deploy a WAF or reverse-proxy rule that inspects request bodies, cookies, and parameters for PHP serialization signatures (O:, a: with object elements, C:) targeting theme endpoints and AJAX handlers, accepting that legitimate serialized data in admin or caching workflows may trigger false positives. Audit the theme for the specific handler feeding unserialize() - commonly demo-import, options-restore, or AJAX callbacks - and disable or block that functionality via a child theme or a must-use plugin if it is not operationally needed, while noting that doing so may break theme setup or migration features. Finally, enable file-integrity monitoring and PHP-level alerting on unexpected writes or outbound connections so that exploitation attempts are detected even before a patch exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 (Deserialization of Untrusted Data) is the root-cause class here: the theme passes attacker-influenced input into PHP's unserialize(), which reconstructs arbitrary objects rather than plain data. Because PHP invokes magic methods such as __wakeup(), __destruct(), and __toString() during object reconstruction and destruction, an attacker who can control the serialized string can steer execution into whatever gadget methods exist in the loaded codebase - a classic PHP Object Injection (POI) pattern widely seen in the WordPress theme and plugin ecosystem. The CPE cpe:2.3:a:axiomthemes:balance:*:*:*:*:*:*:*:* with the description's 'from n/a through 1.12.0' range confirms the affected target is the Axiomthemes Balance theme up to and including 1.12.0, regardless of WordPress core version, meaning the exposure is a function of theme deployment rather than CMS release. The assessed vector's PR:N/UI:N places no authentication or interaction barrier in front of the sink, while AC:H reflects that converting object injection into RCE, file write, or SQL injection requires a viable gadget chain and favorable object-property control - an environmental precondition, not a blanket guarantee of code execution. The publisher-supplied score of 9.8 assumes AC:L; our independent assessment downgrades complexity and therefore effective risk for typical deployments.
Know when Balance gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated object injection (AV:N/PR:N/UI:N) with full impact, but AC:H because reliable exploitation depends on a reachable POP gadget chain not guaranteed to be present.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
Executive ViewAI
The Axiomthemes Balance WordPress theme (versions through 1.12.0) carries a critical object-injection flaw that could let an unauthenticated remote attacker run code inside a hosted website's PHP process, but only if a usable gadget chain exists in the theme, WordPress core, or a co-installed plugin. Every business unit or agency running an affected site on this theme is in scope, and a successful compromise would hand an attacker full control of that site's application context, its content, and any customer or transactional data it handles. No public exploit identified at time of analysis and no confirmed active exploitation, so leadership should treat this as a time-bound remediation and exposure-reduction priority rather than an active incident.
No vendor fix is available. Interim mitigations: remove or deactivate the Axiomthemes Balance theme (all versions through 1.12.0) where it is not essential; where it must remain, deploy WAF/virtual-patching rules that block serialized-object payloads on theme and AJAX endpoints; deactivate and delete unused plugins and themes to shrink the potential POP gadget-chain surface; enable PHP and web-server logging with alerting for anomalous unserialize-style activity; restrict administrative access to the site by IP allow-list and multi-factor authentication; and segment the affected site so that a compromise cannot pivot to other internal systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB