Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112858updated 25 Oct 2026, 17:20 UTC

Rhodos WordPress theme: untrusted data can run code on the site

Attackers can send specially crafted data to the Rhodos WordPress theme and make the website run their commands. That can let them take over the site or reach its data.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted serialized data to the site
  2. 2Website requestMalicious data reaches the Rhodos theme
  3. 3Unsafe object handlingTheme rebuilds objects from untrusted data
  4. 4Code executionAttacker's commands run on the server
  5. ResultAttacker controls the website server

What happened

A deserialization flaw (unsafe handling of untrusted serialized data, leading to object injection) affects the axiomthemes Rhodos WordPress theme in all versions through 1.3.3.

Why it is dangerous: Successful exploitation could let an attacker run code on the web server, change or steal site content and data, and use the site for further attacks. Any site running the affected theme is at risk.

Are you affected?

You are affected if your WordPress site uses the Rhodos theme by axiomthemes, version 1.3.3 or earlier.

axiomthemes Rhodos (rhodos) theme: all versions through 1.3.3

What to do

  1. Check whether the Rhodos theme is installed and what version it is.
  2. Check the theme vendor or WordPress.org for a fixed version and update to it as soon as one is available.
  3. If no fix is available yet, deactivate the Rhodos theme and switch to another theme, or restrict access to the site while you wait.
  4. Review the site for unexpected files, admin users, or changes, and restore from a clean backup if you find any.

Timeline

  1. 23 Oct 2026, 13:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 13:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112858 · GHSA-c7g4-27cm-3cj8
CVSS
9.8 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 13:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Rhodos WordPress theme: untrusted data can run code on the site · Zero Radar