Holistic Center CVE-2026-112854

The flaw is PHP Object Injection via deserialization of untrusted data in the Holistic Center theme (versions through 1.2.6); the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required to reach the vulnerable code. The practical limiting factor is that object injection typically requires a usable POP/magic-method gadget chain in the theme, WordPress core, or co-installed plugins to convert deserialization into concrete code execution or data impact - the available sources do not identify the vulnerable sink, the exact trigger, or confirm a working chain. Exposure is further limited to sites running this specific theme at an affected version.

The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a vuln.today priority of act_now, with the issue reported by Patchstack for the axiomthemes 'Holistic Center' WordPress theme (CWE-502, PHP Object Injection). The CVSS vector describes a network, low-complexity, unauthenticated attack with full confidentiality, integrity and availability impact, which is why the score is critical. However, several corroborating signals are absent: there is no CISA KEV listing, no EPSS score, and no SSVC automatable/technical-impact breakdown in the input, so active exploitation cannot be confirmed - exploitation status is 'no public exploit identified at time of analysis.' A material caveat specific to PHP object injection: achieving the C:H/I:H/A:H impact in the CVSS vector generally depends on a usable POP (property-oriented programming) gadget chain being present in the theme, WordPress core, or other installed plugins; the sources do not describe the trigger or confirm a working chain, so the full 9.8 impact is plausible but not demonstrated here. Net assessment: treat as a genuine high-priority patching item given the act_now label, Patchstack provenance, and unauthenticated network vector, but recognize the critical score is a worst-case rating and real-world exploitability hinges on a gadget chain that the available evidence does not confirm.

A remote attacker sends crafted, attacker-controlled serialized PHP data to an endpoint of the Holistic Center theme that calls unserialize() on untrusted input. If a suitable POP gadget chain exists in the installed WordPress stack, deserialization instantiates attacker-chosen objects and triggers magic methods, potentially leading to code execution, data access, or site compromise. No public exploit code is identified in the provided sources, and the exact vulnerable sink and trigger are not described.