{"id":"CVE-2026-112858","kind":"vulnerability","aliases":["CVE-2026-112858"],"related":[],"title":"Rhodos WordPress theme: untrusted data deserialization enables object injection","description":"Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.","summary":"The Rhodos WordPress theme by axiomthemes (through 1.3.3) deserializes untrusted data, so an unauthenticated remote attacker can inject PHP objects (CVSS 9.8). No patched version exists yet. Patchstack expects mass exploitation, but no exploitation or public PoC is known. Whether it leads to code execution depends on a gadget chain in the site's other plugins.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"Rhodos","fixed":[],"affected":"<= 1.3.3","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["axiomthemes","other","php","rhodos","self-hosted","wordpress"],"not_affected_if":["managed-hosting","theme-not-installed"],"how_to_check":"WordPress admin: Appearance > Themes, check Rhodos version; or read Version in wp-content/themes/rhodos/style.css. 1.3.3 or older is affected, including an inactive but installed copy.","fix":"No official fixed version as of 2026-10-23. Switch to another theme and delete wp-content/themes/rhodos, or put a WAF in front (Patchstack has a virtual-patch rule). Check axiomthemes/ThemeForest for a release later than 1.3.3.","status":"open","published_at":"2026-10-23T13:17:07+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:17+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:31:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown: no fixed version is named in the sources; update past 1.3.3 if a release exists, otherwise remove the theme.","reach":"internet","title":"Rhodos WordPress theme: untrusted data deserialization enables object injection","impact":"high","summary":"The Rhodos WordPress theme by axiomthemes deserializes untrusted input, which lets an attacker inject objects into the site. Versions through 1.3.3 are affected, and the source rates it critical with a CVSS score of 9.8.","category":"other","who_cares":["wordpress","rhodos","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects objects into the site; code execution not confirmed.","analyst_note":"Check the NVD entry and the vendor advisory for a fixed version and whether authentication is required: https://nvd.nist.gov/vuln/detail/CVE-2026-112858","how_to_check":"In WordPress, open Appearance > Themes and check the Rhodos version; 1.3.3 or older is affected.\nunknown","needs_analyst":true,"not_affected_if":["theme-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001091,"input_tokens":2901,"output_tokens":1601,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor advisory for a fixed version and whether authentication is required: https://nvd.nist.gov/vuln/detail/CVE-2026-112858","search":"'-112858':12A,15A '-2026':11A,14A '1.3.3':32B,99C '9.8':46B 'affect':94C 'allow':90C 'attack':40B 'axiomthem':17B,30B,87C 'chain':74B 'code':68B 'cve':10A,13A 'cvss':45B 'data':5A,35B,84C 'depend':70B 'deseri':6A,33B,81C 'enabl':7A 'execut':69B 'exist':50B 'expect':53B 'exploit':55B,58B 'gadget':73B 'host':23B 'inject':9A,42B 'injection.this':92C 'issu':93C 'known':63B 'lead':66B 'mass':54B 'n/a':97C 'object':8A,44B,91C 'patch':48B 'patchstack':52B 'php':19B,43B 'plugin':80B 'poc':61B 'public':60B 'remot':39B 'rhodo':1A,20B,26B,88C,89C,95C 'rhodos':16A 'self':22B 'self-host':21B 'site':77B 'theme':3A,28B 'unauthent':38B 'untrust':4A,34B,83C 'version':49B 'vulner':85C 'whether':64B 'wordpress':2A,24B,27B 'yet':51B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112858","severity":null,"published_at":"2026-10-23T13:17:07+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112858:248","url":null,"severity":null,"published_at":"2026-10-23T22:32:59+00:00","modified_at":"2026-10-23T22:32:59+00:00","first_seen_at":"2026-10-23T22:32:59+00:00","fetched_at":"2026-10-23T22:32:59+00:00","note":"Patchstack (reported 12 Feb 2026, published 21 Oct) and CVE record: unauthenticated PHP object injection, <=1.3.3, no official patch. No exploitation or PoC found; did not search X/social (low-profile theme)."},{"source":"epss","external_id":"CVE-2026-112858","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112858","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1502,"url":"https://patchstack.com/database/wordpress/theme/rhodos/vulnerability/wordpress-rhodos-theme-1-3-3-php-object-injection-vulnerability","title":"Patchstack: Rhodos theme <= 1.3.3 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1503,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112858","title":"CVE Record CVE-2026-112858","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}