CVE-2026-112854: WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
Published Oct 23, 2026
·Updated
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
Affected Software
1 affected component
axiomthemes Holistic Center<=1.2.6
Event History
Oct 23, 2026
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Axiomthemes Holistic Center installations running version 1.2.6 or earlier are affected. The affected range is listed as versions through 1.2.6.
2
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the potential impact if exploited?
The CVSS vector indicates high potential impact to confidentiality, integrity, and availability. The reported weakness is deserialization of untrusted data leading to PHP object injection.