---
id: "CVE-2026-112848"
kind: "vulnerability"
aliases: ["CVE-2026-112848"]
title: "Hostme v2 WordPress theme: object injection via untrusted data"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "hostmev2", "fixed": [], "affected": "<= 7.0", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["aivahthemes", "hostme-v2", "other", "package", "php-object-injection", "theme", "wordpress"]
not_affected_if: ["theme-not-installed"]
published_at: "2026-10-23T13:17:06+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112848", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:36:16+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112848", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Hostme v2 WordPress theme: object injection via untrusted data

The Hostme v2 WordPress theme (AivahThemes), versions up to and including 7.0, passes untrusted data to PHP unserialize (CWE-502). The CVSS vector is network, no privileges, no user interaction, 9.8. No official patch exists. No exploitation or public PoC found yet, but Patchstack expects mass exploitation of this class. The same theme has two other open CVEs: CVE-2026-112849 (XSS) and CVE-2025-68907 (file deletion).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:hostmev2 affected <= 7.0 fixed ?

## How to check

In WordPress admin go to Appearance > Themes and check Hostme v2 version, or run: wp theme list (look for hostmev2 with version <= 7.0). Check wp-content/themes/hostmev2/style.css for the Version header.

## Fix

No fixed version is available (affected: through 7.0). Mitigate by removing or replacing the theme, or by putting a WAF rule in front (Patchstack has a mitigation rule). Watch the vendor/ThemeForest page for a release above 7.0.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112848
- 2026-10-23T22:36:16+00:00 analyst — Patchstack (CNA) advisory + CVE record: Hostme v2 <= 7.0 PHP object injection, CVSS 9.8 AV:N/PR:N (unauthenticated per vector). No patched version; Patchstack says no official patch. No exploitation or public PoC found; no X chatter. Sibling CVEs: -112849 (XSS), CVE-2025-68907 (file deletion). Vendor changelog not found; NVD page unreadable.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112848

## Documents

- [advisory] Patchstack: Hostme v2 <= 7.0 PHP Object Injection https://patchstack.com/database/wordpress/theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-php-object-injection-vulnerability
- [describes] CVE.report CVE-2026-112848 (CNA record) https://cve.report/CVE-2026-112848

## From the sources

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_