{"id":"CVE-2026-112855","kind":"vulnerability","aliases":["CVE-2026-112855"],"related":[],"title":"Redy WordPress theme: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.","summary":"The Redy WordPress theme by axiomthemes deserializes untrusted data, which lets an attacker inject objects into the site. The NVD score is 9.8 (critical), but the sources do not describe the exact exploit path.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","redy-theme","wordpress"],"not_affected_if":["redy-not-installed"],"how_to_check":"In WordPress, open Appearance > Themes and check whether Redy is installed and at version 1.3.5 or lower. Sources do not give a file or setting to inspect.","fix":"Move Redy to a release newer than 1.3.5. The sources do not name the fixed version.","status":"open","published_at":"2026-10-23T13:17:07+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:19+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:31:19Z","model":"claude-haiku-5-5","output":{"fix":"Move Redy to a release newer than 1.3.5. The sources do not name the fixed version.","reach":"internet","title":"Redy WordPress theme: untrusted data deserialization allows object injection","impact":"high","summary":"The Redy WordPress theme by axiomthemes deserializes untrusted data, which lets an attacker inject objects into the site. The NVD score is 9.8 (critical), but the sources do not describe the exact exploit path.","category":"package","who_cares":["wordpress","redy-theme"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Object injection; sources do not state the full worst case.","analyst_note":"Find the fixed Redy version and whether authentication is required, using the NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-112855","how_to_check":"In WordPress, open Appearance > Themes and check whether Redy is installed and at version 1.3.5 or lower. Sources do not give a file or setting to inspect.","needs_analyst":true,"not_affected_if":["redy-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00117,"input_tokens":2888,"output_tokens":1763,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112855':12A,15A '-2026':11A,14A '1.3.5':73C '9.8':43B 'affect':68C 'allow':7A,64C 'attack':33B 'axiomthem':26B,61C 'critic':44B 'cve':10A,13A 'data':5A,29B,58C 'describ':50B 'deseri':6A,27B,55C 'exact':52B 'exploit':53B 'inject':9A,34B 'injection.this':66C 'issu':67C 'let':31B 'n/a':71C 'nvd':40B 'object':8A,35B,65C 'packag':16B 'path':54B 'redi':1A,18B,22B,62C,63C,69C 'redy-them':17B 'score':41B 'site':38B 'sourc':47B 'theme':3A,19B,24B 'untrust':4A,28B,57C 'vulner':59C 'wordpress':2A,20B,23B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112855","severity":null,"published_at":"2026-10-23T13:17:07+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112855","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112855","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}