{"id":"CVE-2026-112857","published":"2026-10-23T13:17:07.447","lastModified":"2026-10-23T16:06:31.143","description":"Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/reprizo/vulnerability/wordpress-reprizo-theme-1-0-8-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Reprizo plugin before 1.0.8 for WordPress suffers from a PHP object injection vulnerability (CWE-502) due to unsafe deserialization of user-supplied data, which could allow an unauthenticated attacker to execute arbitrary code or perform other harmful actions by injecting malicious serialized objects.","exploitability":"Exploitation is straightforward for an unauthenticated remote attacker since no authentication, user interaction, or special conditions are required (CVSS vector AV:N/AC:L/PR:N/UI:N).","blast_radius":"Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption on the affected WordPress site.","remediation":"Upgrade to Reprizo version 1.0.9 or later, which contains a fix for the deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["object-injection","php","wordpress","unauth-rce","deserialization"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:44:01.597Z"}}