Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through… (CVE-2026-112857)

CVE-2026-112857 describes a deserialization of untrusted data vulnerability in the axiomthemes Reprizo plugin (reprizo) that permits object injection attacks. This vulnerability affects all versions up to and including 1.0.8. Exploitation could allow an attacker to execute arbitrary code or manipulate application logic, resulting in complete compromise of the affected system. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided at this time.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker can inject malicious objects during deserialization, potentially resulting in remote code execution or other severe impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or restrict exposure of the vulnerable component to untrusted inputs.