{"id":"CVE-2026-93930","published":"2026-10-10T08:17:05.300","lastModified":"2026-10-13T13:28:15.717","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/tantra/vulnerability/wordpress-tantra-theme-2-9-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows untrusted data deserialization that can lead to arbitrary object injection, potentially enabling remote code execution or complete system compromise. The flaw affects ThemeREX Group's Tantra theme through version 2.9.0.","exploitability":"Exploitation is likely straightforward with minimal preconditions, as the vulnerability occurs during deserialization of untrusted data without requiring user authentication or specific interaction.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise and data exfiltration across all installations running Tantra versions up to 2.9.0.","remediation":"Upgrade to version 2.9.1 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:44:39.419Z"}}