Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic… (CVE-2026-112854)

CVE-2026-112854 is a deserialization of untrusted data vulnerability in the Holistic Center plugin by axiomthemes. The vulnerability allows attackers to perform object injection attacks by exploiting unsafe deserialization processes. This can lead to remote code execution or other severe impacts. The affected versions include all releases up to and including 1.2.6. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in complete system compromise, including unauthorized remote code execution, data breach, and service disruption. The vulnerability is exploitable remotely without authentication or user interaction, making it highly dangerous.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected application and monitor for suspicious activity related to object injection attempts.