Reprizo WordPress theme: PHP Object Injection
Summary
The Reprizo WordPress theme up to and including version 1.0.8 contains a deserialization flaw (CWE-502) that allows PHP object injection. An unauthenticated attacker can send crafted input to a public site to manipulate how data is processed, which can lead to harmful actions on the server. Patchstack rates it as high priority with CVSS 9.8; whether code execution is possible depends on gadget chains present on the site, which were not verified.
Affected
- Reprizo theme (AxiomThemes), versions up to and including 1.0.8
- Versions and fix status according to Patchstack and the CVE record
Fixed in
Unknown. Patchstack lists no official patch. Newer theme versions exist, but none has been confirmed as fixing this issue.
Workaround
- No vendor workaround known.
- Patchstack offers virtual patching as a commercial mitigation (not a vendor fix).
- If the theme is not in active use, deactivate and remove it.
Exploitation
- Not known as exploited in the sources reviewed.
- Patchstack expects exploitation (forecast, not observed).
- No public proof of concept found.
Our recommendation
- Inventory all WordPress sites for the Reprizo theme and its version (theme folder and style.css header).
- For sites with version 1.0.8 or lower: contact AxiomThemes or the purchaser for a fixed version, or replace the theme.
- Enable a WAF or virtual patching as an interim measure.
- Restrict admin access and create a backup before changes.
- Review logs and file integrity for signs of compromise, as the flaw has been public since 21 October 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability entry patchstack.com
- NVD record via Vulners vulners.com
- Vulnrichment via Vulners vulners.com
- Known exploitation status (HOL Guard) hol.org
- AxiomThemes Reprizo product page axiomthemes.com
- ThemeForest listing themeforest.net
- Ionix threat center www.ionix.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:47.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.