---
id: "CVE-2026-112855"
kind: "vulnerability"
aliases: ["CVE-2026-112855"]
title: "Redy WordPress theme: untrusted data deserialization allows object injection"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "redy-theme", "wordpress"]
not_affected_if: ["redy-not-installed"]
published_at: "2026-10-23T13:17:07+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112855", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112855", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Redy WordPress theme: untrusted data deserialization allows object injection

The Redy WordPress theme by axiomthemes deserializes untrusted data, which lets an attacker inject objects into the site. The NVD score is 9.8 (critical), but the sources do not describe the exact exploit path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

In WordPress, open Appearance > Themes and check whether Redy is installed and at version 1.3.5 or lower. Sources do not give a file or setting to inspect.

## Fix

Move Redy to a release newer than 1.3.5. The sources do not name the fixed version.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112855
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112855

## From the sources

Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_