---
id: "CVE-2026-54860"
kind: "vulnerability"
aliases: ["CVE-2026-54860"]
title: "Ozisti WordPress plugin: unauthenticated PHP object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Ozisti", "fixed": [], "affected": "<= 1.1.10", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["ozisti", "package", "php", "themerex", "unauthenticated", "wordpress", "wordpress-theme"]
not_affected_if: ["managed-hosting-with-waf", "newer-version", "not-installed", "theme-not-installed"]
published_at: "2026-10-29T16:18:10+00:00"
first_seen_at: "2026-10-29T16:25:59+00:00"
updated_at: "2026-10-29T16:31:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54860", "first_seen_at": "2026-10-29T16:25:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:31:37+00:00"}]
---

# Ozisti WordPress plugin: unauthenticated PHP object injection lets attackers run code

The Ozisti WordPress theme (ThemeREX), versions 1.1.10 and earlier, accepts untrusted serialized PHP data from unauthenticated requests. This allows PHP object injection, which can lead to code execution depending on available gadget chains. Patchstack lists no official patch.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:Ozisti affected <= 1.1.10 fixed ?

## How to check

- In WordPress admin go to Appearance > Themes, or open wp-content/themes/ozisti/style.css and read the Version header.
- Exposed if the Ozisti theme is installed (active or not) at version 1.1.10 or older.

## Fix

No patched version listed by Patchstack as of 2026-10-13. Unknown whether the vendor has released one; check ThemeREX. Until then remove or replace the theme, or use a WAF rule (Patchstack publishes a mitigation rule for its customers).

## Timeline

- 2026-10-29T16:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54860
- 2026-10-29T16:31:37+00:00 analyst — Correction: Ozisti is a ThemeREX WordPress THEME, not a plugin. Source is Patchstack DB (third party, not vendor); NVD page returned nothing. Patchstack lists <=1.1.10, CVSS 9.8, unauthenticated, no official patch as of 2026-10-13, reported by johska. Nothing verified; no vendor page found, no exploitation or PoC found. Sibling: CVE-2026-28093 LFI in same theme <=1.1.10.

## Documents

- [advisory] Patchstack: WordPress Ozisti Theme <= 1.1.10 PHP Object Injection https://patchstack.com/database/wordpress/theme/ozisti/vulnerability/wordpress-ozisti-theme-1-1-10-php-object-injection-vulnerability

## From the sources

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_