PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112857 axiomthemes CVE debrief

A critical vulnerability was found in the Reprizo theme for WordPress, affecting versions up to 1.0.8. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8 and is considered critical. The Reprizo theme, used in conjunction with WordPress, is susceptible to this vulnerability, which could allow attackers to inject malicious PHP objects. This could lead to various impacts, including potential code execution and data breaches. Defenders and administrators should assess exposure and apply patches or updates to mitigate this critical vulnerability.

Vendor
axiomthemes
Product
Reprizo
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Defenders and administrators of WordPress installations using the Reprizo theme should assess exposure and apply patches or updates to mitigate this critical vulnerability.

Why it matters

CVE-2026-112857 is a critical vulnerability in the Reprizo theme for WordPress, allowing for PHP Object Injection. Defenders should assess exposure, apply patches, and monitor for suspicious activity to mitigate potential impacts.

  • Potential for code execution on affected systems
  • Possible data breaches due to object injection
  • Required verification of Reprizo theme versions and exposure
  • Need for immediate patching or mitigation

Technical summary

The Reprizo theme for WordPress, version up to 1.0.8, is vulnerable to PHP Object Injection due to deserialization of untrusted data. This issue has a CVSS score of 9.8 and is considered critical. The vulnerability arises from the theme's insecure handling of PHP object deserialization, which could allow attackers to inject malicious objects. This could lead to various technical impacts, including potential code execution and data breaches.

Defensive priority

High priority for defenders to assess exposure and apply patches

Recommended defensive actions

  • Assess exposure of Reprizo theme versions up to 1.0.8
  • Apply patches or updates to Reprizo theme
  • Monitor for suspicious activity related to PHP Object Injection

Evidence notes

The vulnerability was reported by axiomthemes and is documented in the CVE Program record and NVD vulnerability detail pages. The evidence provided by axiomthemes indicates that the Reprizo theme versions up to 1.0.8 are affected. However, the exact scope of affected deployments and potential exposure is not detailed in the source information. Defenders should verify the version of the Reprizo theme in use and assess potential exposure based on the provided CVE and NVD details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112857 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112857

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112857 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112857

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.