How do I check whether I am affected by CVE-2026-112848?

In WordPress admin go to Appearance > Themes and check Hostme v2 version, or run: wp theme list (look for hostmev2 with version <= 7.0). Check wp-content/themes/hostmev2/style.css for the Version header.

What is the fix for CVE-2026-112848?

No fixed version is available (affected: through 7.0). Mitigate by removing or replacing the theme, or by putting a WAF rule in front (Patchstack has a mitigation rule). Watch the vendor/ThemeForest page for a release above 7.0.

Who is not affected by CVE-2026-112848?

Not affected if: theme-not-installed.

Live › vulnerability › CVE-2026-112848

Go to dashboard

critical9.8Package

Hostme v2 WordPress theme: object injection via untrusted data

Q: What is the fix for CVE-2026-112848?

No fixed version is available (affected: through 7.0). Mitigate by removing or replacing the theme, or by putting a WAF rule in front (Patchstack has a mitigation rule). Watch the vendor/ThemeForest page for a release above 7.0.

Q: Who is not affected by CVE-2026-112848?

Not affected if: theme-not-installed.

The Hostme v2 WordPress theme (AivahThemes), versions up to and including 7.0, passes untrusted data to PHP unserialize (CWE-502). The CVSS vector is network, no privileges, no user interaction, 9.8. No official patch exists. No exploitation or public PoC found yet, but Patchstack expects mass exploitation of this class. The same theme has two other open CVEs: CVE-2026-112849 (XSS) and CVE-2025-68907 (file deletion).

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs code on the server via crafted serialized objects.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-112848

Go to dashboard

critical9.8Package

Hostme v2 WordPress theme: object injection via untrusted data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs code on the server via crafted serialized objects.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Hostme v2 WordPress theme: object injection via untrusted data

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Hostme v2 WordPress theme: object injection via untrusted data

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources