Live › vulnerability › CVE-2026-54860
The Ozisti WordPress theme (ThemeREX), versions 1.1.10 and earlier, accepts untrusted serialized PHP data from unauthenticated requests. This allows PHP object injection, which can lead to code execution depending on available gadget chains. Patchstack lists no official patch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Ozisti product at version 1.1.10 or older are exposed, since the flaw needs no login. Sites on newer versions or without Ozisti can skip it. The sources do not describe the exact code path or default configuration.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ozisti | wordpress-theme | <= 1.1.10 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54860")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.