PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112858 axiomthemes CVE debrief

A critical vulnerability was found in the WordPress Rhodos theme, affecting versions up to 1.3.3. This issue allows for PHP Object Injection due to deserialization of untrusted data. The vulnerability has a CVSS score of 9.8 and is considered critical. WordPress administrators and users of the Rhodos theme should assess their exposure and prioritize remediation to prevent potential code execution, elevation of privileges, and data tampering. The vulnerability was reported by axiomthemes and is documented in the CVE Program record and NVD vulnerability detail pages.

Vendor
axiomthemes
Product
Rhodos
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-24
Advisory published
2026-10-23
Advisory updated
2026-10-24

Who should care

WordPress administrators and users of the Rhodos theme should assess their exposure and prioritize remediation to prevent potential code execution, elevation of privileges, and data tampering. This includes reviewing and restricting untrusted data deserialization in the application, implementing additional security measures to prevent object injection attacks, and confirming whether affected product deployments exist

Why it matters

CVE-2026-112858 is a critical vulnerability in the WordPress Rhodos theme that allows for PHP Object Injection. WordPress administrators and users of the affected theme should prioritize remediation to prevent potential code execution, elevation of privileges, and data tampering.

  • Potential code execution through deserialization of untrusted data
  • Possible elevation of privileges through object injection
  • Data tampering and unauthorized access may occur

Technical summary

The Rhodos theme for WordPress is vulnerable to PHP Object Injection due to deserialization of untrusted data. This issue affects Rhodos versions from n/a through 1.3.3. The vulnerability has a CVSS score of 9.8 and is considered critical. WordPress administrators and users of the Rhodos theme should assess their exposure and prioritize remediation to prevent potential code execution, elevation of privileges, and data tampering.

Defensive priority

High priority remediation is recommended for WordPress installations using the Rhodos theme version 1.3.3 or earlier.

Recommended defensive actions

  • Update the Rhodos theme to a version beyond 1.3.3
  • Review and restrict untrusted data deserialization in the application
  • Implement additional security measures to prevent object injection attacks

Evidence notes

The vulnerability was reported by axiomthemes and is documented in the CVE Program record and NVD vulnerability detail pages. The CVE record was published on 2026-10-23T13:00:17.505Z and has not been modified since then. There are no additional details on the vulnerability beyond what is provided in the CVE Program record and NVD vulnerability detail pages.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112858 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112858

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112858 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112858

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.