CVE-2026-112848: WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
Published Oct 23, 2026
·Updated
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
Affected Software
1 affected component
Aivahthemes Hostme v2<=7.0
Event History
Oct 23, 2026
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
AivahThemes Hostme v2 installations are affected through version 7.0. The affected version range begins at an unspecified earlier version.
2
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What impact could successful exploitation have?
The supplied CVSS vector rates confidentiality, integrity, and availability impact as high. The vulnerability is rated critical with a 9.8 score.