Loading vulnerability…
PHP Object Injection in Axiomthemes Veto
CVE-2026-93927 is an untrusted-data deserialization vulnerability in the Axiomthemes Veto WordPress theme that permits PHP object injection. It affects versions through 1.6.0; the lower affected-version boundary is unspecified. The vulnerable function and specific input handling mechanism have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits PHP object injection through deserialization of attacker-controlled data. Specific downstream consequences, such as code execution, data disclosure, or service disruption, are not established by the available technical information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.