What is the CVSS score of CVE-2026-112848?

CVE-2026-112848 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-112848?

Within 24 hours, identify all instances of the AivahThemes Hostme v2 theme (versions through 7.0) across your web estate and, if the theme is not essential, disable and remove it; if required, apply virtual patching via a web application firewall (WAF) to block exploit attempts. Within 7 days, monitor vendor channels for a patch release and, if available, deploy it immediately; if not, evaluate alternative themes and plan migration, and ensure WAF rules are updated based on emerging threat intelligence. Within 30 days, complete migration to a supported alternative theme or apply the vendor patch once released, and conduct a security review of all WordPress sites to identify similar risks and harden configurations.

Hostme v2 CVE-2026-112848

EUVD-2026-108956 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-10-23 Patchstack

GHSA-f5gh-pc33-83rx

WordPress Deserialization Wordpress Theme Hostme V2

9.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach WordPress site running Hostme v2
Delivery

Craft malicious serialized PHP object
Exploit

Submit to vulnerable deserialization sink
Execution

Trigger PHP object injection via gadget chain
Impact

Achieve code execution or data compromise

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation targets the AivahThemes Hostme v2 WordPress theme (versions through 7.0) and requires untrusted input to reach a PHP unserialize() sink in the theme (CWE-502). The description does not name the exact parameter, endpoint, or configuration that reaches the sink, so the precise trigger is not described in the available sources. As a practical limiting factor, PHP Object Injection only yields meaningful impact when an exploitable gadget chain is present in WordPress core, the theme, or other installed plugins - absent a usable chain, impact may be reduced. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, and the site must have the Hostme v2 theme installed and the affected code path active. No fixed version is listed in the available evidence.
Impact	The input signals are only partly aligned. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) and CWE-502 describe an unauthenticated, network-reachable PHP Object Injection with full confidentiality, integrity and availability impact, and the vuln.today Decision label is 'act_now', which raises urgency. Reinforcing this, the finding comes from Patchstack, a credible WordPress-vulnerability source. Counter-balancing signals, however, are largely MISSING rather than negative: no EPSS probability is supplied, there is no CISA KEV listing, and no verified working exploit is provided - only a single Patchstack database reference. PHP Object Injection scored at PR:N/AC:L assumes a reachable, unauthenticated entry point AND an exploitable gadget chain (typically from the WordPress core or an installed plugin/theme); neither the reachable sink nor a confirmed gadget chain is described in the available sources, so the practical 9.8 may overstate out-of-the-box exploitability. Net: treat as a high priority consistent with the act_now label, but recognize that real-world impact depends on an available gadget chain that the evidence does not confirm.
Exploit ScenarioDerived	A remote attacker sends a crafted request to the Hostme v2 theme carrying a malicious serialized PHP object, which is deserialized by vulnerable theme code (CWE-502), triggering PHP Object Injection. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required; if a suitable gadget chain is present in WordPress or installed extensions, this can escalate to arbitrary file operations or code execution. A public PoC reference exists (Patchstack database entry); it is not verified as working exploit code, and the exact trigger is not described in the available sources.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 23, 2026

PHP object injection in the AivahThemes Hostme v2 WordPress theme (all versions through 7.0) allows unauthenticated remote attackers to pass serialized data into a PHP unserialize() sink, which can lead to arbitrary object instantiation and, where a usable gadget chain exists, code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any site running the theme with the affected code path active is exposed. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and no CISA KEV entry indicates confirmed active exploitation. The precise request parameter or endpoint that reaches the sink is not described in the available sources, and no fixed version is listed in the evidence.

RemediationAI

No vendor-released patch or fixed version is identified in the available evidence, so the complete fix is not yet confirmed; check the Patchstack advisory (https://patchstack.com/database/wordpress/theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-php-object-injection-vulnerability?_s_id=cve) and the theme vendor for an update before deploying one. Until a fix is published, the most direct compensating control is to deactivate and remove the Hostme v2 theme from production sites, which eliminates the vulnerable code path entirely at the cost of losing the theme's design and functionality. Because object injection requires the affected code path to be reachable, disabling any theme-specific endpoints, AJAX actions, or shortcodes that process serialized input reduces exposure, though the sources do not identify which one reaches the sink, so this cannot be targeted precisely. Reducing the number of installed plugins and keeping WordPress core current limits the availability of POP gadget chains that turn the injection into code execution, but this is a risk reduction rather than a fix. A WAF rule blocking serialized PHP object payloads (strings matching O:\d+:" or a:\d+:{) in request bodies offers partial protection with the trade-off of possible false positives on legitimate serialized data.

Affected VersionsENISA

Hostme v2 0 ≤7.0

Affected Packages

euvd hostme_v2 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-502 (Deserialization of Untrusted Data) in a WordPress theme arises when attacker-influenced input is passed to PHP's unserialize() without validation. PHP object injection does not by itself execute code: it instantiates arbitrary classes, and impact depends on whether a POP gadget chain (magic methods such as __wakeup, __destruct, __toString) exists in the theme, WordPress core, or another installed plugin. When such a chain exists, the result can be arbitrary file write, SQL injection, or remote code execution; absent a usable chain, impact may be reduced. The affected package is the AivahThemes Hostme v2 theme (CPE cpe:2.3:a:aivahthemes:hostme_v2, versions through 7.0), a commercial WordPress theme. The sources do not specify which parameter, AJAX action, REST route, or shortcode handler reaches the unserialize() call, so the exact trigger is unverified; the exploited code path must also be active on the target site for the flaw to be reachable.

Know when Hostme V2 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

CWE-502 object injection reachable remotely without auth or interaction (AV:N/AC:L/PR:N/UI:N); a successful gadget chain typically yields full C/I/A impact within the WordPress instance (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

Executive ViewAI

Why It Matters

The Hostme v2 WordPress theme, used by an unknown number of sites, contains a critical vulnerability that allows unauthenticated attackers to potentially take full control of affected websites. This puts customer data, site integrity, and brand reputation at risk, and could lead to regulatory and legal consequences. Leadership should prioritize remediation because the vulnerability is easy to exploit and has a severe impact on confidentiality, integrity, and availability.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 54% exploitable

Prevalence

Low

niche commercial WordPress theme from a single small vendor

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.