Is CVE-2026-93945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93945 being exploited in the wild.

How severe is CVE-2026-93945?

Critical severity, with a CVSS score of 9.8, published 10 October 2026.

Which products and versions are affected?

Axiomthemes Balance through 1.12.0.

How is CVE-2026-93945 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93945?

Check whether you run Axiomthemes Balance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93945: Axiomthemes Balance PHP object injection

CVE-2026-93945 · Severity: critical · CVSS 9.8 · Published 2026-10-10

The Axiomthemes Balance WordPress theme contains a PHP object injection vulnerability that allows attackers to manipulate how the website processes data and execute arbitrary code on the server. Since no authentication is required, an unauthenticated attacker can exploit this flaw to take control of the affected website and potentially compromise all associated data.

Vendors: Axiomthemes.

Quick answers

Is CVE-2026-93945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93945 being exploited in the wild.
How severe is CVE-2026-93945?: Critical severity, with a CVSS score of 9.8, published 10 October 2026.
Which products and versions are affected?: Axiomthemes Balance through 1.12.0.
Is there a fix for CVE-2026-93945?: No fixed version is recorded yet. Patchstack has issued a mitigation rule to block exploitation attempts until an official patch becomes available. Contact your hosting provider or web developer for immediate assistance if unable to update the theme directly.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93945 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93945?: Check whether you run Axiomthemes Balance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Patchstack has issued a mitigation rule to block exploitation attempts until an official patch becomes available. Contact your hosting provider or web developer for immediate assistance if unable to update the theme directly.</anigation> </invoke>

Technical details

This is a PHP object injection vulnerability in the Balance WordPress theme versions through 1.12.0 that enables attackers to instantiate and manipulate arbitrary objects, leading to remote code execution. The vulnerability requires no authentication or user interaction and is accessible over the network, making it readily exploitable. No official patch is currently available.

Affected products

Axiomthemes Balance through 1.12.0

Timeline

2026-10-10: disclosed
2026-10-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.