How do I check whether I am affected by CVE-2026-112855?

In WordPress, open Appearance > Themes and check whether Redy is installed and at version 1.3.5 or lower. Sources do not give a file or setting to inspect.

What is the fix for CVE-2026-112855?

Move Redy to a release newer than 1.3.5. The sources do not name the fixed version.

Who is not affected by CVE-2026-112855?

Not affected if: redy-not-installed.

Live › vulnerability › CVE-2026-112855

Go to dashboard

critical9.8Package

Redy WordPress theme: untrusted data deserialization allows object injection

The Redy WordPress theme by axiomthemes deserializes untrusted data, which lets an attacker inject objects into the site. The NVD score is 9.8 (critical), but the sources do not describe the exact exploit path.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far4 of 6

missing: versions, primary source

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.6% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Object injection; sources do not state the full worst case.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-112855

Go to dashboard

critical9.8Package

Redy WordPress theme: untrusted data deserialization allows object injection

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far4 of 6

missing: versions, primary source

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.6% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Object injection; sources do not state the full worst case.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

Redy WordPress theme: untrusted data deserialization allows object injection

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Redy WordPress theme: untrusted data deserialization allows object injection

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources