Reprizo WordPress Theme CVE-2026-112857

The description states only that Reprizo through 1.0.8 deserializes untrusted data and 'allows Object Injection' - it does NOT name the specific endpoint, parameter, protocol, or configuration that reaches the vulnerable deserialize call, so the trigger is not described in the available sources. The supplied CVSS vector claims no authentication (PR:N) and no user interaction (UI:N), implying default exposure, but this cannot be independently verified from the description alone. The principal LIMITING factor for realistic impact is inherent to PHP object injection: meaningful compromise generally requires a usable POP gadget chain present in the theme or an installed plugin, and the sources do not confirm such a chain exists for Reprizo. Deployment is also limited to sites running this specific axiomthemes theme at version 1.0.8 or earlier.

This is a PHP Object Injection flaw (CWE-502) in the axiomthemes 'Reprizo' WordPress theme, versions up to and including 1.0.8, reported by Patchstack and assigned a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vuln.today decision label is act_now, which aligns with the maximal severity score and signals this should be treated as a priority for patching rather than a high-CVSS-but-low-real-risk issue. However, several key exploitation signals are MISSING and must be stated explicitly: there is NO EPSS score provided, so exploitation probability cannot be quantified; KEV status is NOT indicated, so there is no evidence of confirmed active exploitation; and the sole reference is the Patchstack database advisory, not a working exploit, so no public exploit code is identified. The CVSS vector asserts remote, unauthenticated, no-interaction exploitation, but the description does not describe HOW the vulnerable deserialization is reached - the trigger is not described in the available sources. For PHP object injection specifically, the real-world C:H/I:H/A:H impact typically depends on a usable POP gadget chain being present in the theme or an installed plugin, and the sources do not confirm such a chain, so the worst-case impact is asserted by the vendor rather than demonstrated. Net: treat as a genuine high priority to patch (act_now), but note the urgency rests on severity and the decision label, not on confirmed exploitation or a verified PoC.

A remote attacker submits crafted, serialized PHP data to a Reprizo theme code path that deserializes untrusted input, instantiating attacker-controlled objects. If a suitable POP gadget chain is reachable in the theme or site, this object injection can escalate to file operations, SQL interaction, or remote code execution on the WordPress host. No public exploit code is identified at time of analysis, and the exact triggering endpoint is not described in the available sources.