Rhodos WordPress theme: PHP Object Injection via untrusted data deserialization

Summary

The Rhodos WordPress theme by axiomthemes, versions up to and including 1.3.3, deserializes untrusted data, which allows PHP Object Injection. According to the CNA's CVSS 3.1 vector, an unauthenticated remote attacker could potentially compromise confidentiality, integrity and availability of the website, for example by taking over the site or planting malware. The vector requires no privileges and no user interaction; Patchstack's required-privilege field was blank, so this has not been fully confirmed.

Affected

• Rhodos theme from n/a through 1.3.3
• Newer versions are not confirmed as fixed; treat them as unverified.

Fixed in

Unknown. No official patch confirmed by the vendor or Patchstack at the time of research.

Workaround

• Patchstack advises updating the theme; if no fix is available, ask the hosting provider or web developer for help.
• Put a WAF or virtual patch in front of the site as a temporary measure; coverage not verified.
• Replace the theme with a maintained alternative if Rhodos is not essential.

Exploitation

• No confirmed known exploitation; not listed in CISA KEV per one source.
• Patchstack expects exploitation based on severity; this is a prediction.
• No public proof of concept found in the sources reviewed.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Inventory all WordPress sites using Rhodos, including staging and client sites.
• Treat exposed sites as high priority: replace the theme or apply a fix once the vendor confirms one.
• Apply a WAF or virtual patch as a stopgap and restrict wp-admin and wp-login.php by IP or VPN with MFA.
• Keep WordPress core, PHP and plugins up to date.
• Back up the site and review files, users and scheduled tasks for unexpected changes.
• Do not use nulled copies of the theme.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Vulners NVD mirror vulners.com
• HOL Guard hol.org
• Strix CVE record www.strix.ai
• Qualys detection notice notifications.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:47.