External risk intelligence

Redy Theme Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-112855

The vulnerability affects a WordPress theme. WordPress themes are public-facing web components that are designed to be accessible via the internet as part of a web application's front end, making them a common part of internet-reachable deployment patterns.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Redy theme, allowing for unauthorized code execution due to the improper handling of untrusted data. This could potentially enable attackers to inject malicious objects into the system, impacting its integrity and availability. The main concern at this stage is to confirm if our organization utilizes this specific theme and, if so, to what extent.

Untrusted data allows code injection.
Critical flaw could compromise systems.
Confirm theme use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a vulnerable installation of the Redy theme. This data would be processed in a way that allows for the injection of arbitrary objects, potentially leading to the execution of malicious code.

No authentication required for attack.
Malicious data triggers object injection.
Leads to system compromise.

Live Threat

Current exploitation, exposure, and threat context

This deserialization vulnerability in the Redy theme could allow an attacker to inject malicious objects into the system. When supported by the advisory, this might occur when the Redy theme processes untrusted data, potentially leading to unauthorized actions or data manipulation on the affected site.

Theme's object processing.
Untrusted data input.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vendor responsible for the Redy theme is likely accountable for addressing this deserialization vulnerability. Infrastructure or platform teams should first identify all deployments of the affected theme, confirm their internet reachability and business criticality, and then coordinate with the vendor or responsible application owner to plan remediation.

Theme developers/owners are responsible.
Verify theme reachability and business impact.
Coordinate vendor fix or implement controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Redy theme?

Redy is a WordPress theme by axiomthemes used to define the visual design, layout, and user interface elements of a website. Themes like Redy act as a layer on top of the WordPress core software, managing how content is presented to visitors. Because it integrates directly into the site's front end, it handles various data inputs to render pages dynamically for users.

What does CVE-2026-112855 mean by object injection?

This vulnerability is classified as CWE-502, or Deserialization of Untrusted Data. It occurs when the theme takes data provided by an outside user and converts it back into an object without proper checks. If that data is malicious, the system might inadvertently execute unintended commands, effectively allowing an attacker to manipulate the application's internal logic and behavior.

How is this vulnerability triggered?

The flaw is triggered when the Redy theme processes specially crafted, untrusted data sent to the site. An attacker does not need to be logged in to initiate this request. Simply interacting with specific parts of the theme that handle this data can trigger the vulnerability; it does not require a user to perform complex actions or bypass existing password protections to set the injection in motion.

Do I need to worry if my site uses Redy?

Yes, if you use the affected versions, you should pay attention. According to Halo Surface Signal, WordPress themes are inherently designed to be web-facing components. Because this theme operates as part of the public front end of your application, it is likely reachable via the internet, increasing the accessibility for potential external probes against this specific flaw.

When should I take action for this CVE?

You should prioritize assessing your environment immediately to locate any installations of the Redy theme. Once you have identified where the theme is deployed, determine if it is internet-facing or handles sensitive business processes. Coordinate with your team to track official updates from the theme vendor, as they are responsible for providing the necessary fix to sanitize how the theme handles incoming data.

References

patchstack.com/database/wordpress/theme/redy/vulnerability/wordpress…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.