Object Injection Vulnerability in Holistic Center Theme by AxiomThemes
CVE-2026-112854

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Holistic Center
Vendor
CVE Published:
23 October 2026

What is CVE-2026-112854?

A deserialization of untrusted data vulnerability exists in the Holistic Center theme from AxiomThemes, allowing for potential object injection exploits. This vulnerability affects versions from n/a up to and including 1.2.6, exposing users to risks where an attacker can manipulate serialized data leading to unauthorized actions or exposure of sensitive information. It is crucial for users to update their theme to mitigate these risks and ensure the integrity of their web applications.

Affected Version(s)

Holistic Center 0 <= 1.2.6

References

https://patchstack.com/database/wordpress/theme/holistic-...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
.