CVE-2026-112856: WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Q: Who can exploit this vulnerability?

The CVSS vector indicates it is network-accessible, requires no privileges, and requires no user interaction. An unauthenticated remote attacker could exploit it if the affected vulnerable functionality is reachable.

Q: Which installations are affected?

Vagabonds versions through 1.3.10 are affected. The provided information does not identify a safe fixed version or any configuration prerequisite.

Q: What is the potential impact?

The issue is rated critical with a 9.8 CVSS score and has high confidentiality, integrity, and availability impacts. Successful object injection may therefore lead to severe compromise of affected sites.

Published Oct 23, 2026

Updated

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

Affected Software

1 affected component

ThemeREX Group Vagabonds<=1.3.10

Event History

Oct 23, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

The CVSS vector indicates it is network-accessible, requires no privileges, and requires no user interaction. An unauthenticated remote attacker could exploit it if the affected vulnerable functionality is reachable.

Which installations are affected?

Vagabonds versions through 1.3.10 are affected. The provided information does not identify a safe fixed version or any configuration prerequisite.

What is the potential impact?

The issue is rated critical with a 9.8 CVSS score and has high confidentiality, integrity, and availability impacts. Successful object injection may therefore lead to severe compromise of affected sites.

CVE-2026-112856: WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which installations are affected?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which installations are affected?

What is the potential impact?