{"id":"CVE-2026-54860","kind":"vulnerability","aliases":["CVE-2026-54860"],"related":[],"title":"Ozisti WordPress plugin: unauthenticated PHP object injection lets attackers run code","description":"Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.","summary":"The Ozisti WordPress theme (ThemeREX), versions 1.1.10 and earlier, accepts untrusted serialized PHP data from unauthenticated requests. This allows PHP object injection, which can lead to code execution depending on available gadget chains. Patchstack lists no official patch.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ozisti","fixed":[],"affected":"<= 1.1.10","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["ozisti","package","php","themerex","unauthenticated","wordpress","wordpress-theme"],"not_affected_if":["managed-hosting-with-waf","newer-version","not-installed","theme-not-installed"],"how_to_check":"- In WordPress admin go to Appearance > Themes, or open wp-content/themes/ozisti/style.css and read the Version header.\n- Exposed if the Ozisti theme is installed (active or not) at version 1.1.10 or older.","fix":"No patched version listed by Patchstack as of 2026-10-13. Unknown whether the vendor has released one; check ThemeREX. Until then remove or replace the theme, or use a WAF rule (Patchstack publishes a mitigation rule for its customers).","status":"open","published_at":"2026-10-29T16:18:10+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:27:36+00:00","updated_at":"2026-10-29T16:31:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ozisti WordPress plugin: unauthenticated PHP object injection lets attackers run code","impact":"high","summary":"Ozisti versions 1.1.10 and earlier accept untrusted serialized PHP data without authentication. An attacker who sends a crafted request can inject PHP objects, which can lead to code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ozisti","php","wordpress"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker may run code on the server","analyst_note":"Confirm the affected product (WordPress plugin or other), the fixed version and the vulnerable endpoint from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-54860.","how_to_check":"- Check the installed Ozisti version in the plugin list or plugin main file header.\n- Confirm whether the installed version is `1.1.10` or older.","plain_action":"","needs_analyst":true,"not_affected_if":["newer-version","not-installed"],"who_is_affected":"Sites running the Ozisti product at version 1.1.10 or older are exposed, since the flaw needs no login. Sites on newer versions or without Ozisti can skip it. The sources do not describe the exact code path or default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000662,"input_tokens":4053,"output_tokens":514,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected product (WordPress plugin or other), the fixed version and the vulnerable endpoint from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-54860.","search":"'-2026':13A,16A '-54860':14A,17A '1.1.10':34B,72C 'accept':37B 'allow':46B 'attack':9A 'avail':58B 'chain':60B 'code':11A,54B 'cve':12A,15A 'data':41B 'depend':56B 'earlier':36B 'execut':55B 'gadget':59B 'inject':7A,49B,69C 'lead':52B 'let':8A 'list':62B 'object':6A,48B,68C 'offici':64B 'ozisti':1A,18A,19B,29B,71C 'packag':20B 'patch':65B 'patchstack':61B 'php':5A,21B,40B,47B,67C 'plugin':3A 'request':44B 'run':10A 'serial':39B 'theme':27B,31B 'themerex':22B,32B 'unauthent':4A,23B,43B,66C 'untrust':38B 'version':33B,73C 'wordpress':2A,24B,26B,30B 'wordpress-them':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ozisti product at version 1.1.10 or older are exposed, since the flaw needs no login. Sites on newer versions or without Ozisti can skip it. The sources do not describe the exact code path or default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54860","severity":null,"published_at":"2026-10-29T16:18:10+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-54860:1054","url":null,"severity":null,"published_at":"2026-10-29T16:31:37+00:00","modified_at":"2026-10-29T16:31:37+00:00","first_seen_at":"2026-10-29T16:31:37+00:00","fetched_at":"2026-10-29T16:31:37+00:00","note":"Correction: Ozisti is a ThemeREX WordPress THEME, not a plugin. Source is Patchstack DB (third party, not vendor); NVD page returned nothing. Patchstack lists <=1.1.10, CVSS 9.8, unauthenticated, no official patch as of 2026-10-13, reported by johska. Nothing verified; no vendor page found, no exploitation or PoC found. Sibling: CVE-2026-28093 LFI in same theme <=1.1.10."}],"documents":[{"id":17753,"url":"https://patchstack.com/database/wordpress/theme/ozisti/vulnerability/wordpress-ozisti-theme-1-1-10-php-object-injection-vulnerability","title":"Patchstack: WordPress Ozisti Theme <= 1.1.10 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}