CVE-2026-112856EUVD-2026-108947GHSA-7846-572J-93WR
WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Vagabonds theme for WordPress, made by ThemeREX, is affected. An attacker could exploit this flaw to inject malicious serialized data, which may allow them to run unintended code, access or change data, or take control of the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Affected versions
- vagabonds
through 1.3.10