{"id":"CVE-2026-112848","kind":"vulnerability","aliases":["CVE-2026-112848"],"related":[],"title":"Hostme v2 WordPress theme: object injection via untrusted data","description":"Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.","summary":"The Hostme v2 WordPress theme (AivahThemes), versions up to and including 7.0, passes untrusted data to PHP unserialize (CWE-502). The CVSS vector is network, no privileges, no user interaction, 9.8. No official patch exists. No exploitation or public PoC found yet, but Patchstack expects mass exploitation of this class. The same theme has two other open CVEs: CVE-2026-112849 (XSS) and CVE-2025-68907 (file deletion).","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"hostmev2","fixed":[],"affected":"<= 7.0","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["aivahthemes","hostme-v2","other","package","php-object-injection","theme","wordpress"],"not_affected_if":["theme-not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and check Hostme v2 version, or run: wp theme list (look for hostmev2 with version <= 7.0). Check wp-content/themes/hostmev2/style.css for the Version header.","fix":"No fixed version is available (affected: through 7.0). Mitigate by removing or replacing the theme, or by putting a WAF rule in front (Patchstack has a mitigation rule). Watch the vendor/ThemeForest page for a release above 7.0.","status":"open","published_at":"2026-10-23T13:17:06+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:20+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:31:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Hostme v2 WordPress theme: object injection via untrusted data","impact":"high","summary":"The Hostme v2 WordPress theme from AivahThemes deserializes untrusted input, which allows object injection. Per the NVD entry, an attacker can exploit this to run code or alter application data on the site (CVSS 9.8, critical).","category":"package","who_cares":["wordpress","hostme-v2","aivahthemes"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server via crafted serialized objects","analyst_note":"Confirm the fixed version and whether unauthenticated requests reach the vulnerable code; check the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-112848 and the vendor changelog.","how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes; the advisory lists versions through 7.0 as affected.","needs_analyst":true,"not_affected_if":["theme-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000498,"input_tokens":2911,"output_tokens":414,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether unauthenticated requests reach the vulnerable code; check the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2026-112848 and the vendor changelog.","search":"'-112848':12A,15A '-112849':89B '-2025':93B '-2026':11A,14A,88B '-502':48B '-68907':94B '7.0':40B,117C '9.8':59B 'affect':111C 'aivahthem':17B,34B,103C 'allow':107C 'class':78B 'cve':10A,13A,87B,92B 'cves':86B 'cvss':50B 'cwe':47B 'data':9A,43B,100C 'delet':96B 'deseri':97C 'exist':63B 'expect':73B 'exploit':65B,75B 'file':95B 'found':69B 'hostm':1A,19B,30B,104C,112C 'hostme-v2':18B 'hostmev2':16A,106C 'includ':39B 'inject':6A,26B 'injection.this':109C 'interact':58B 'issu':110C 'mass':74B 'n/a':115C 'network':53B 'object':5A,25B,108C 'offici':61B 'open':85B 'packag':22B 'pass':41B 'patch':62B 'patchstack':72B 'php':24B,45B 'php-object-inject':23B 'poc':68B 'privileg':55B 'public':67B 'theme':4A,27B,33B,81B 'two':83B 'unseri':46B 'untrust':8A,42B,99C 'user':57B 'v2':2A,20B,31B,105C,113C 'vector':51B 'version':35B 'via':7A 'vulner':101C 'wordpress':3A,28B,32B 'xss':90B 'yet':70B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112848","severity":null,"published_at":"2026-10-23T13:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112848:260","url":null,"severity":null,"published_at":"2026-10-23T22:36:16+00:00","modified_at":"2026-10-23T22:36:16+00:00","first_seen_at":"2026-10-23T22:36:16+00:00","fetched_at":"2026-10-23T22:36:16+00:00","note":"Patchstack (CNA) advisory + CVE record: Hostme v2 <= 7.0 PHP object injection, CVSS 9.8 AV:N/PR:N (unauthenticated per vector). No patched version; Patchstack says no official patch. No exploitation or public PoC found; no X chatter. Sibling CVEs: -112849 (XSS), CVE-2025-68907 (file deletion). Vendor changelog not found; NVD page unreadable."},{"source":"epss","external_id":"CVE-2026-112848","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112848","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1530,"url":"https://patchstack.com/database/wordpress/theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-php-object-injection-vulnerability","title":"Patchstack: Hostme v2 <= 7.0 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1532,"url":"https://cve.report/CVE-2026-112848","title":"CVE.report CVE-2026-112848 (CNA record)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}