CVE-2026-112858

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

axiomthemes Rhodos

Open in Threatline Record JSON

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version yet

Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-112858 - rhodos The Rhodos theme for WordPress (versions up to 1.3.3) can be tricked into loading and running code supplied by an attacker. This could let an attacker takeBluesky: CVE posts, 23 Oct 2026

Description

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

Text from CVE List

Affected versions 1

Rhodosaffected: all versions through 1.3.3CVE List

References 1

patchstack.com/database/wordpress/theme/rhodos/vulnerability/wordpress-rhodos-theme-1-3-3-php-object-injection-vulnerability?_s_id=cveReferencevia CVE List