Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Holistic Center WordPress theme lets attackers run code

CVE-2026-112854 · published today
Summary

The Holistic Center theme for WordPress (versions up to 1.2.6) can be tricked into processing malicious data, which may let an attacker execute code on your website. This could lead to unauthorized changes, data theft, or site takeover. Update the theme to a newer version or replace it with a secure alternative as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
axiomthemes holistic center <= 1.2.6
Original advisory text
WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published23 Oct 2026
Updated23 Oct 2026
First seen23 Oct 2026
Sources
CVE-2026-112854 · NVD
CVE-2026-112854 · MITRE
Track software like this
Free during beta