Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112855updated 25 Oct 2026, 17:20 UTC

Redy WordPress theme: untrusted data can run unintended code

A flaw in the Redy WordPress theme lets an attacker feed it specially crafted data that the site then processes as commands. This can let strangers take control of the website.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted serialized data to the site
  2. 2Redy themeUnserializes the untrusted input without checks
  3. 3Object injectionMalicious object is created on the server
  4. 4Code executionAttacker gains control of the web server
  5. ResultAttacker controls the website server

What happened

The Redy theme by axiomthemes contains an unsafe deserialization flaw (object injection, CWE-502), where untrusted input is unserialized and can instantiate arbitrary objects. Affected versions are all releases through 1.3.5.

Why it is dangerous: A successful attacker could run code on the server, read or change site data, or take over the site, which is critical at a CVSS score of 9.8. Any site running the affected Redy theme is at risk.

Are you affected?

You are affected if your website uses the Redy theme by axiomthemes at version 1.3.5 or earlier.

Redy theme by axiomthemes, all versions through 1.3.5

What to do

  1. Check whether the Redy theme is installed and note its version
  2. Update to a fixed version of Redy as soon as the vendor releases one; check the theme's update page
  3. If no fix is available, deactivate and remove the Redy theme and switch to a maintained theme
  4. Review the site for unexpected admin users or modified files

Timeline

  1. 23 Oct 2026, 13:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 13:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112855 · GHSA-rp4f-997r-jc7c
CVSS
9.8 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 13:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Redy WordPress theme: untrusted data can run unintended code · Zero Radar