---
id: "CVE-2026-112858"
kind: "vulnerability"
aliases: ["CVE-2026-112858"]
title: "Rhodos WordPress theme: untrusted data deserialization enables object injection"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "other"
products: [{"name": "Rhodos", "fixed": [], "affected": "<= 1.3.3", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["axiomthemes", "other", "php", "rhodos", "self-hosted", "wordpress"]
not_affected_if: ["managed-hosting", "theme-not-installed"]
published_at: "2026-10-23T13:17:07+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112858", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:32:59+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112858", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Rhodos WordPress theme: untrusted data deserialization enables object injection

The Rhodos WordPress theme by axiomthemes (through 1.3.3) deserializes untrusted data, so an unauthenticated remote attacker can inject PHP objects (CVSS 9.8). No patched version exists yet. Patchstack expects mass exploitation, but no exploitation or public PoC is known. Whether it leads to code execution depends on a gadget chain in the site's other plugins.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Rhodos affected <= 1.3.3 fixed ?

## How to check

WordPress admin: Appearance > Themes, check Rhodos version; or read Version in wp-content/themes/rhodos/style.css. 1.3.3 or older is affected, including an inactive but installed copy.

## Fix

No official fixed version as of 2026-10-23. Switch to another theme and delete wp-content/themes/rhodos, or put a WAF in front (Patchstack has a virtual-patch rule). Check axiomthemes/ThemeForest for a release later than 1.3.3.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112858
- 2026-10-23T22:32:59+00:00 analyst — Patchstack (reported 12 Feb 2026, published 21 Oct) and CVE record: unauthenticated PHP object injection, <=1.3.3, no official patch. No exploitation or PoC found; did not search X/social (low-profile theme).
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112858

## Documents

- [advisory] Patchstack: Rhodos theme <= 1.3.3 PHP Object Injection https://patchstack.com/database/wordpress/theme/rhodos/vulnerability/wordpress-rhodos-theme-1-3-3-php-object-injection-vulnerability
- [describes] CVE Record CVE-2026-112858 https://www.cve.org/CVERecord?id=CVE-2026-112858

## From the sources

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_