Vagabonds WordPress theme: PHP Object Injection via untrusted deserialization
Summary
The Vagabonds WordPress theme up to and including version 1.3.10 deserializes untrusted data, which allows PHP object injection. Patchstack rates the flaw as critical (CVSS 9.8) and states that it can be triggered without authentication. Depending on the available gadget chains, an attacker could manipulate server-side processing and potentially execute code on the web server. No official fix is confirmed and no public proof of concept or confirmed exploitation has been found.
Affected
- Vagabonds WordPress theme, versions up to and including 1.3.10 (per Patchstack and CVE record)
- Vendor and version naming should be verified: the ThemeForest listing names AxiomThemes as author
- Pirated or nulled copies of the theme are likely to be affected as well
Fixed in
Unknown. No official patch is confirmed by Patchstack or the vendor. Newer releases (for example 1.3.12 and 1.3.14 on ThemeForest) are not confirmed to fix this CVE.
Workaround
- Remove or deactivate the theme if it is not essential and switch to a maintained theme
- Apply a virtual patch (for example the Patchstack mitigation rule) and restrict access to wp-admin where possible; a WAF rule is a stopgap, not a fix
- Back up the site before making changes
Exploitation
- Known exploited: not confirmed; CISA KEV listing not found
- Patchstack expects exploitation but this is a prediction, not evidence
- Public proof of concept: none found in searches
- EPSS: 0.00313 (low modelled probability for the next 30 days)
- Required privilege: unauthenticated
Our recommendation
- Identify all sites running this theme, including staging sites and nulled copies
- Replace or disable the theme where it is not needed
- Apply a virtual patch or access restriction now and monitor for a vendor fix
- Check for compromise: unknown admin users, modified PHP files, unexpected uploads
- Re-check the Patchstack entry, the ThemeForest changelog and NVD for a confirmed fixed version before closing the item
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- EUVD-2026-108947 vulners.com
- Vulners NVD record CVE-2026-112856 vulners.com
- HOL CVE entry hol.org
- ThemeForest product page themeforest.net
- ThemeREX product page themerex.net
- OWASP PHP Object Injection community.owasp.org
- Patchstack PHP object injection article patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:46.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.