Live › vulnerability › CVE-2026-112858
Go to dashboardThe Rhodos WordPress theme by axiomthemes (through 1.3.3) deserializes untrusted data, so an unauthenticated remote attacker can inject PHP objects (CVSS 9.8). No patched version exists yet. Patchstack expects mass exploitation, but no exploitation or public PoC is known. Whether it leads to code execution depends on a gadget chain in the site's other plugins.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Rhodos | wordpress-theme | <= 1.3.3 | – |
WordPress admin: Appearance > Themes, check Rhodos version; or read Version in wp-content/themes/rhodos/style.css. 1.3.3 or older is affected, including an inactive but installed copy.
1.3.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-112858")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.