Holistic Center WordPress theme: PHP Object Injection

Summary

The Holistic Center WordPress theme by axiomthemes up to and including version 1.2.6 contains a deserialization of untrusted data flaw that allows PHP Object Injection. According to Patchstack, an unauthenticated attacker can send crafted data to the website to manipulate how it processes data and run harmful actions on the server. The theme runs on the public website, so exposed sites are likely reachable without a login.

Affected

• Holistic Center WordPress theme, versions 0 to and including 1.2.6
• Patchstack lists the vulnerable range as <= 1.2.6

Fixed in

Unknown. No vendor advisory or fixed version has been confirmed for this CVE.

Workaround

• Check whether the theme is active on each site; remove it if it is not needed
• If it is needed, move the site to a different theme or place it behind a managed virtual-patching service
• Restrict access to the WordPress admin area and keep WordPress core and other plugins up to date

Exploitation

• Known exploited in the wild: no evidence found
• Public proof of concept: none found
• CISA SSVC: exploitation none, automatable no, technical impact total
• Patchstack expects exploitation but this is a prediction, not an observed attack
• EPSS is low (about 0.3%)

Our recommendation

• Check whether any site runs Holistic Center up to version 1.2.6 and whether the theme is active
• Treat affected sites as high priority and escalate if they run a shop or handle customer or staff data
• Remove the theme if unused, or apply a virtual patch or move to another theme until a confirmed fix is available
• Monitor the vendor and Patchstack for an advisory and check the site logs for unusual requests

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• NVD mirror (Vulners) vulners.com
• Strix CVE page www.strix.ai
• VulDB entry vuldb.com
• Install Guard (HOL) hol.org
• ThemeForest listing themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:45.