CVE-2026-112854

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center…

Risk score: 69/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.3%
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability (CVSS 9.8) in axiomthemes Holistic Center allows Object Injection through deserialization of untrusted data. An attacker could remotely exploit this without logging in, potentially leading to high impact.
Affected: {'products': ['Holistic Center'], 'packages': [], 'versions': ['from n/a through 1.2.6']}
Fix: Check the linked advisory for a fix, as none is provided.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

https://patchstack.com/database/wordpress/theme/holistic-center/vulnerability/wordpress-holistic-center-theme-1-2-6-php-object-injection-vulnerability?_s_id=cve

Original description

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

Last activity 23 Oct 2026. Patch Forecast updates every hour.