CVE-2026-112848

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

AivahThemes Hostme v2

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 24 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Published23 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@hugovalters.bsky.social: CVE-2026-112848 - Critical Insecure Deserialization in AivahThemes Hostme v2 (<= 7.0) allows Object Injection. CVSS 9.8. Currently unpatched. Audit now. #CVE #infosec #cybersecuritBluesky: CVE posts, 23 Oct 2026

Description

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

Text from CVE List

Affected versions 1

Hostme v2affected: all versions through 7.0CVE List

References 1

patchstack.com/database/wordpress/theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-php-object-injection-vulnerability?_s_id=cveReferencevia CVE List