---
id: "CVE-2026-112856"
kind: "vulnerability"
aliases: ["CVE-2026-112856"]
title: "WordPress Vagabonds theme: object injection lets attackers run code via deserialization"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "vagabonds", "fixed": [], "affected": "<= 1.3.10", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["package", "php", "runtime", "themerex", "vagabonds-theme", "wordpress"]
not_affected_if: ["theme-not-installed", "theme-version-above-1.3.10"]
published_at: "2026-10-23T13:17:07+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112856", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:36:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112856", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# WordPress Vagabonds theme: object injection lets attackers run code via deserialization

The Vagabonds WordPress theme (ThemeREX) through 1.3.10 unsafely deserializes untrusted data (PHP object injection, CWE-502). The CVSS vector says no login is needed (network, low complexity, no privileges). No patch exists. Patchstack expects mass exploitation. Whether a usable gadget chain exists for code execution depends on the site's other plugins and themes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:vagabonds affected <= 1.3.10 fixed ?

## How to check

In WordPress admin, go to Appearance > Themes and check whether Vagabonds is installed (active or not) and its version. Or look at wp-content/themes/vagabonds/style.css for 'Version:'. 1.3.10 or lower is affected.

## Fix

No fixed version published as of 2026-10-23. Remove the theme (inactive installs too) or switch to another theme. A Patchstack virtual patch rule exists. Watch ThemeREX for a release above 1.3.10.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112856
- 2026-10-23T22:36:08+00:00 analyst — Patchstack advisory + CVE record: unauthenticated (PR:N, CVSS 9.8), <=1.3.10, no official patch. No exploitation or public PoC found; Patchstack says expected to be mass-exploited. Did not search social.
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112856

## Documents

- [advisory] Patchstack: Vagabonds <= 1.3.10 PHP Object Injection https://patchstack.com/database/wordpress/theme/vagabonds/vulnerability/wordpress-vagabonds-theme-1-3-10-php-object-injection-vulnerability
- [describes] CVE Record CVE-2026-112856 https://www.cve.org/CVERecord?id=CVE-2026-112856

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_