Live › vulnerability › CVE-2026-112857
Go to dashboardReprizo (axiomthemes) up to 1.0.8 deserializes untrusted data (PHP object injection, CWE-502), CVSS 9.8, unauthenticated by vector. The vendor changelog for 1.0.15 (June 2026) says it fixed unserialize of data from scheme_storage and skin options during skin installation/activation, which is probably the vulnerable path. No exploitation or public PoC known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Reprizo | wordpress-theme | <= 1.0.8 | – |
Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css in the Reprizo theme directory; versions through 1.0.8 are affected.
1.0.15 or later (vendor changelog, ThemeForest; updates via the ThemeREX Updater plugin or a fresh download with your purchase code)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-112857")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.