How do I check whether I am affected by CVE-2026-112856?

In WordPress admin, go to Appearance > Themes and check whether Vagabonds is installed (active or not) and its version. Or look at wp-content/themes/vagabonds/style.css for 'Version:'. 1.3.10 or lower is affected.

What is the fix for CVE-2026-112856?

No fixed version published as of 2026-10-23. Remove the theme (inactive installs too) or switch to another theme. A Patchstack virtual patch rule exists. Watch ThemeREX for a release above 1.3.10.

Who is not affected by CVE-2026-112856?

Not affected if: theme-not-installed, theme-version-above-1.3.10.

Live › vulnerability › CVE-2026-112856

Go to dashboard

critical9.8Packagewordpress-theme

WordPress Vagabonds theme: object injection lets attackers run code via deserialization

The Vagabonds WordPress theme (ThemeREX) through 1.3.10 unsafely deserializes untrusted data (PHP object injection, CWE-502). The CVSS vector says no login is needed (network, low complexity, no privileges). No patch exists. Patchstack expects mass exploitation. Whether a usable gadget chain exists for code execution depends on the site's other plugins and themes.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.6% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Code runs on the server; secrets readable.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-112856

Go to dashboard

critical9.8Packagewordpress-theme

WordPress Vagabonds theme: object injection lets attackers run code via deserialization

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.6% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Code runs on the server; secrets readable.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

WordPress Vagabonds theme: object injection lets attackers run code via deserialization

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

WordPress Vagabonds theme: object injection lets attackers run code via deserialization

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources