{"id":"CVE-2026-112856","kind":"vulnerability","aliases":["CVE-2026-112856"],"related":[],"title":"WordPress Vagabonds theme: object injection lets attackers run code via deserialization","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.","summary":"The Vagabonds WordPress theme (ThemeREX) through 1.3.10 unsafely deserializes untrusted data (PHP object injection, CWE-502). The CVSS vector says no login is needed (network, low complexity, no privileges). No patch exists. Patchstack expects mass exploitation. Whether a usable gadget chain exists for code execution depends on the site's other plugins and themes.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"vagabonds","fixed":[],"affected":"<= 1.3.10","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["package","php","runtime","themerex","vagabonds-theme","wordpress"],"not_affected_if":["theme-not-installed","theme-version-above-1.3.10"],"how_to_check":"In WordPress admin, go to Appearance > Themes and check whether Vagabonds is installed (active or not) and its version. Or look at wp-content/themes/vagabonds/style.css for 'Version:'. 1.3.10 or lower is affected.","fix":"No fixed version published as of 2026-10-23. Remove the theme (inactive installs too) or switch to another theme. A Patchstack virtual patch rule exists. Watch ThemeREX for a release above 1.3.10.","status":"open","published_at":"2026-10-23T13:17:07+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:13+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:31:13Z","model":"claude-haiku-5-5","output":{"fix":"Update Vagabonds to a version later than 1.3.10 (the affected range is from n/a through 1.3.10). If no fixed version is published, remove or replace the theme.","reach":"internet","title":"WordPress Vagabonds theme: object injection lets attackers run code via deserialization","impact":"high","summary":"The Vagabonds WordPress theme by ThemeREX unsafely deserializes untrusted data, which allows PHP object injection. The sources do not say whether an unauthenticated visitor can trigger it, but a successful injection can lead to remote code execution on the site.","category":"package","who_cares":["wordpress","vagabonds-theme","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"code runs on the server; secrets readable","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112856 for the fixed version and whether the entry point needs authentication.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["theme-not-installed","theme-version-above-1.3.10"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000503,"input_tokens":2910,"output_tokens":424,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112856 for the fixed version and whether the entry point needs authentication.","search":"'-112856':14A,17A '-2026':13A,16A '-502':42B '1.3.10':33B,100C 'affect':95C 'allow':91C 'attack':7A 'chain':67B 'code':9A,70B 'complex':53B 'cve':12A,15A 'cvss':44B 'cwe':41B 'data':37B,84C 'depend':72B 'deseri':11A,35B,81C 'execut':71B 'exist':58B,68B 'expect':60B 'exploit':62B 'gadget':66B 'group':88C 'inject':5A,40B 'injection.this':93C 'issu':94C 'let':6A 'login':48B 'low':52B 'mass':61B 'n/a':98C 'need':50B 'network':51B 'object':4A,39B,92C 'packag':19B 'patch':57B 'patchstack':59B 'php':20B,38B 'plugin':78B 'privileg':55B 'run':8A 'runtim':21B 'say':46B 'site':75B 'theme':3A,25B,30B,80B 'themerex':22B,31B,87C 'unsaf':34B 'untrust':36B,83C 'usabl':65B 'vagabond':2A,24B,28B,89C,90C,96C 'vagabonds':18A 'vagabonds-them':23B 'vector':45B 'via':10A 'vulner':85C 'whether':63B 'wordpress':1A,26B,29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112856","severity":null,"published_at":"2026-10-23T13:17:07+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112856:258","url":null,"severity":null,"published_at":"2026-10-23T22:36:08+00:00","modified_at":"2026-10-23T22:36:08+00:00","first_seen_at":"2026-10-23T22:36:08+00:00","fetched_at":"2026-10-23T22:36:08+00:00","note":"Patchstack advisory + CVE record: unauthenticated (PR:N, CVSS 9.8), <=1.3.10, no official patch. No exploitation or public PoC found; Patchstack says expected to be mass-exploited. Did not search social."},{"source":"epss","external_id":"CVE-2026-112856","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112856","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1526,"url":"https://patchstack.com/database/wordpress/theme/vagabonds/vulnerability/wordpress-vagabonds-theme-1-3-10-php-object-injection-vulnerability","title":"Patchstack: Vagabonds <= 1.3.10 PHP Object Injection","kind":"advisory","source":"analyst","text":"Vagabonds theme <= 1.3.10 vulnerable to PHP Object Injection, CVSS 9.8. No official patch available. Published 21 Oct 2026. Patchstack mitigation rule available.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1527,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112856","title":"CVE Record CVE-2026-112856","kind":"other","source":"analyst","text":"Deserialization of Untrusted Data in ThemeREX Group Vagabonds, affected 0 through 1.3.10. CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N. CWE-502. Credit: Joao Pedro S Alcantara (Kinorth), Patchstack Bug Bounty.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}