{"id":"CVE-2026-112857","kind":"vulnerability","aliases":["CVE-2026-112857"],"related":[],"title":"WordPress Reprizo theme: untrusted data deserialization lets unauthenticated attackers inject objects","description":"Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.","summary":"Reprizo (axiomthemes) up to 1.0.8 deserializes untrusted data (PHP object injection, CWE-502), CVSS 9.8, unauthenticated by vector. The vendor changelog for 1.0.15 (June 2026) says it fixed unserialize of data from scheme_storage and skin options during skin installation/activation, which is probably the vulnerable path. No exploitation or public PoC known.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"Reprizo","fixed":[],"affected":"<= 1.0.8","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["axiomthemes","deserialization","package","php","reprizo","runtime","unauthenticated","wordpress"],"not_affected_if":["theme-not-installed","version-above-1.0.8"],"how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css in the Reprizo theme directory; versions through 1.0.8 are affected.","fix":"Update Reprizo to 1.0.15 or later (vendor changelog, ThemeForest; updates via the ThemeREX Updater plugin or a fresh download with your purchase code). The changelog does not name the CVE, so check the installed version afterward. Patchstack still lists no patch. If you cannot update, remove the theme or use a WAF/Patchstack rule.","status":"open","published_at":"2026-10-23T13:17:07+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:13+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:31:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Reprizo theme: untrusted data deserialization lets unauthenticated attackers inject objects","impact":"high","summary":"The Reprizo WordPress theme by axiomthemes deserializes untrusted input, which is PHP object injection. Per the NVD score of 9.8, an unauthenticated attacker can likely reach code execution or read data on the site.","category":"package","who_cares":["wordpress","reprizo","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the server or reads secrets via PHP object injection.","analyst_note":"Confirm whether a fixed Reprizo release exists after 1.0.8 and which endpoint is vulnerable, using the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-112857.","how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css in the Reprizo theme directory; versions through 1.0.8 are affected.","needs_analyst":true,"not_affected_if":["theme-not-installed","version-above-1.0.8"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2949,"output_tokens":439,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a fixed Reprizo release exists after 1.0.8 and which endpoint is vulnerable, using the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-112857.","search":"'-112857':14A,17A '-2026':13A,16A '-502':39B '1.0.15':49B '1.0.8':31B,97C '2026':51B '9.8':41B 'affect':92C 'allow':88C 'attack':9A 'axiomthem':19B,28B,85C 'changelog':47B 'cve':12A,15A 'cvss':40B 'cwe':38B 'data':5A,34B,57B,82C 'deseri':6A,20B,32B,79C 'exploit':74B 'fix':54B 'inject':10A,37B 'injection.this':90C 'installation/activation':66B 'issu':91C 'june':50B 'known':78B 'let':7A 'n/a':95C 'object':11A,36B,89C 'option':63B 'packag':21B 'path':72B 'php':22B,35B 'poc':77B 'probabl':69B 'public':76B 'reprizo':2A,18A,23B,27B,86C,87C,93C 'runtim':24B 'say':52B 'scheme':59B 'skin':62B,65B 'storag':60B 'theme':3A 'unauthent':8A,25B,42B 'unseri':55B 'untrust':4A,33B,81C 'vector':44B 'vendor':46B 'vulner':71B,83C 'wordpress':1A,26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112857","severity":null,"published_at":"2026-10-23T13:17:07+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112857:161","url":null,"severity":null,"published_at":"2026-10-23T22:03:54+00:00","modified_at":"2026-10-23T22:03:54+00:00","first_seen_at":"2026-10-23T22:03:54+00:00","fetched_at":"2026-10-23T22:03:54+00:00","note":"Patchstack (CNA) page: Reprizo <= 1.0.8, no official patch, mitigation rule only; vector AV:N/PR:N so unauthenticated per CVSS. No exploitation or public PoC found; skipped social search (niche theme). Same theme also has unpatched LFI CVE-2026-22326."},{"source":"analyst","external_id":"CVE-2026-112857:256","url":null,"severity":null,"published_at":"2026-10-23T22:35:01+00:00","modified_at":"2026-10-23T22:35:01+00:00","first_seen_at":"2026-10-23T22:35:01+00:00","fetched_at":"2026-10-23T22:35:01+00:00","note":"New: vendor changelog on ThemeForest lists 1.0.15 (2026-06-15) fixing object injection in unserialize of scheme_storage and skin options during skin install/activation. Changelog does not cite the CVE; matching is my inference. Patchstack still says no official patch (stale). Not independently verified by reading the code."},{"source":"epss","external_id":"CVE-2026-112857","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112857","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1296,"url":"https://patchstack.com/database/wordpress/theme/reprizo/vulnerability/wordpress-reprizo-theme-1-0-8-php-object-injection-vulnerability","title":"Patchstack: Reprizo <= 1.0.8 PHP Object Injection","kind":"advisory","source":"analyst","text":"Reprizo <= 1.0.8 vulnerable. No official patch available. CVSS 9.8. Patchstack mitigation rule available. Published 21 Oct 2026.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1299,"url":"https://github.com/advisories/GHSA-4jgx-23fw-g479","title":"GHSA-4jgx-23fw-g479 CVE-2026-112857","kind":"other","source":"analyst","text":"Unreviewed; CVSS 9.8 AV:N/AC:L/PR:N/UI:N; affected from n/a through 1.0.8; patched versions unknown.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1514,"url":"https://themeforest.net/item/reprizo-jewelry-watch-shop-wordpress-theme/27898992","title":"Reprizo changelog (ThemeForest, vendor axiomthemes)","kind":"release","source":"analyst","text":"15.06.2026 Version 1.0.15. Fixed: a potential Object Injection vulnerability during unserialize of data from scheme_storage and skin options during skin installation/activation. Also PHP 8.5 compat, WP 7.0 compat. 01.12.2025 Version 1.0.14: Security: Fixed potential LFI vulnerability during pagination.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}