Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through… (CVE-2026-112858)

CVE-2026-112858 describes a deserialization of untrusted data vulnerability in the axiomthemes Rhodos WordPress theme, affecting all versions through 1.3.3. This vulnerability allows attackers to perform object injection attacks by exploiting unsafe deserialization processes. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the vulnerability is remotely exploitable over the network without authentication or user interaction, and can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Successful exploitation can result in full system compromise, including unauthorized code execution, data disclosure, and service disruption. The vulnerability affects the core functionality of the Rhodos theme, potentially allowing attackers to inject malicious objects during deserialization, leading to arbitrary code execution or other severe impacts.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict access to vulnerable installations and monitor for suspicious activity related to deserialization. Avoid using untrusted data inputs in the theme if possible.