CVE-2026-112848EUVD-2026-108956GHSA-F5GH-PC33-83RX
WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Hostme v2 WordPress theme by AivahThemes is affected by this vulnerability. An attacker could exploit the unsafe handling of untrusted data to inject PHP objects, which could potentially lead to code execution, data theft, or site compromise.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
Affected versions
- hostmev2
through 7.0