---
id: "CVE-2026-112857"
kind: "vulnerability"
aliases: ["CVE-2026-112857"]
title: "WordPress Reprizo theme: untrusted data deserialization lets unauthenticated attackers inject objects"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "Reprizo", "fixed": [], "affected": "<= 1.0.8", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["axiomthemes", "deserialization", "package", "php", "reprizo", "runtime", "unauthenticated", "wordpress"]
not_affected_if: ["theme-not-installed", "version-above-1.0.8"]
published_at: "2026-10-23T13:17:07+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112857", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:03:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:35:01+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112857", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# WordPress Reprizo theme: untrusted data deserialization lets unauthenticated attackers inject objects

Reprizo (axiomthemes) up to 1.0.8 deserializes untrusted data (PHP object injection, CWE-502), CVSS 9.8, unauthenticated by vector. The vendor changelog for 1.0.15 (June 2026) says it fixed unserialize of data from scheme_storage and skin options during skin installation/activation, which is probably the vulnerable path. No exploitation or public PoC known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Reprizo affected <= 1.0.8 fixed ?

## How to check

Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css in the Reprizo theme directory; versions through 1.0.8 are affected.

## Fix

Update Reprizo to 1.0.15 or later (vendor changelog, ThemeForest; updates via the ThemeREX Updater plugin or a fresh download with your purchase code). The changelog does not name the CVE, so check the installed version afterward. Patchstack still lists no patch. If you cannot update, remove the theme or use a WAF/Patchstack rule.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112857
- 2026-10-23T22:03:54+00:00 analyst — Patchstack (CNA) page: Reprizo <= 1.0.8, no official patch, mitigation rule only; vector AV:N/PR:N so unauthenticated per CVSS. No exploitation or public PoC found; skipped social search (niche theme). Same theme also has unpatched LFI CVE-2026-22326.
- 2026-10-23T22:35:01+00:00 analyst — New: vendor changelog on ThemeForest lists 1.0.15 (2026-06-15) fixing object injection in unserialize of scheme_storage and skin options during skin install/activation. Changelog does not cite the CVE; matching is my inference. Patchstack still says no official patch (stale). Not independently verified by reading the code.
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112857

## Documents

- [advisory] Patchstack: Reprizo <= 1.0.8 PHP Object Injection https://patchstack.com/database/wordpress/theme/reprizo/vulnerability/wordpress-reprizo-theme-1-0-8-php-object-injection-vulnerability
- [fix] Reprizo changelog (ThemeForest, vendor axiomthemes) https://themeforest.net/item/reprizo-jewelry-watch-shop-wordpress-theme/27898992
- [mentions] GHSA-4jgx-23fw-g479 CVE-2026-112857 https://github.com/advisories/GHSA-4jgx-23fw-g479

## From the sources

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_