CVE-2026-112854

Summary

The Holistic Center plugin before 1.2.6 contains a deserialization vulnerability (CWE-502) that allows unauthenticated remote attackers to inject arbitrary PHP objects, potentially leading to remote code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions beyond network access to the vulnerable endpoint.

Blast radius

Successful exploitation could allow full compromise of the affected WordPress site, including unauthorized data access, modification, or server-side code execution, potentially affecting all users and backend systems accessible to the web server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Holistic Center version 1.2.7 or later, as the vulnerability is fixed in that release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.