{"id":"CVE-2026-112854","kind":"vulnerability","aliases":["CVE-2026-112854"],"related":[],"title":"WordPress Holistic Center theme: object injection lets attackers run code","description":"Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.","summary":"The Holistic Center WordPress theme by axiomthemes unsafely deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input may be able to run code on the site or read data it can reach.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axiomthemes","holistic-center","package","self-hosted","wordpress"],"not_affected_if":["theme-deactivated","theme-not-installed"],"how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes, or inspect style.css for the Version header; versions through 1.2.6 are affected.","fix":"Update Holistic Center to a version later than 1.2.6 once the vendor releases one; if none is available, deactivate the theme. Source does not name a fixed version: unknown.","status":"open","published_at":"2026-10-23T13:17:07+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:16+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:31:16Z","model":"claude-haiku-5-5","output":{"fix":"Update Holistic Center to a version later than 1.2.6 once the vendor releases one; if none is available, deactivate the theme. Source does not name a fixed version: unknown.","reach":"internet","title":"WordPress Holistic Center theme: object injection lets attackers run code","impact":"high","summary":"The Holistic Center WordPress theme by axiomthemes unsafely deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input may be able to run code on the site or read data it can reach.","category":"package","who_cares":["wordpress","holistic-center","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server or reads site secrets via object injection.","analyst_note":"Confirm the fixed version and which endpoint or parameter takes the untrusted input, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112854.","how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes, or inspect style.css for the Version header; versions through 1.2.6 are affected.","needs_analyst":true,"not_affected_if":["theme-not-installed","theme-deactivated"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000524,"input_tokens":2901,"output_tokens":468,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112854':13A,16A '-2026':12A,15A '1.2.6':86C 'abl':51B 'affect':80C 'allow':38B,76C 'attack':8A,43B 'axiomthem':17B,32B,70C 'center':3A,20B,28B,72C,75C,82C 'code':10A,54B 'craft':47B 'cve':11A,14A 'data':36B,60B,67C 'deseri':34B,64C 'holist':2A,19B,27B,71C,74C,81C 'holistic-cent':18B,73C 'host':24B 'inject':6A,41B 'injection.this':78C 'input':48B 'issu':79C 'let':7A 'may':49B 'n/a':84C 'object':5A,40B,77C 'packag':21B 'php':39B 'reach':63B 'read':59B 'run':9A,53B 'self':23B 'self-host':22B 'send':46B 'site':57B 'theme':4A,30B 'unsaf':33B 'untrust':35B,66C 'vulner':68C 'wordpress':1A,25B,29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112854","severity":null,"published_at":"2026-10-23T13:17:07+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112854","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112854","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}