CVE-2026-54860: PHP Injection in Ozisti 1.1.10

CVE-2026-54860 describes an unauthenticated PHP object injection in the Ozisti theme, versions up to 1.1.10. The vulnerability allows an attacker without credentials to inject PHP objects, potentially enabling arbitrary code execution or data manipulation. All administrators with the theme installed are immediately affected.

The CVSS score is 9.8, classified as critical. The vulnerability was made public on October 29, 2026 by NVD. No security update has been reported as available from the developer yet. Social media signals remain limited (1 post, 4 interactions in the last 24 hours), but the simplicity of exploitation and lack of authentication requirement make it immediately exploitable by anyone with knowledge of the vulnerable endpoint.

System administrators and IT teams must immediately verify which WordPress installations are running Ozisti theme version 1.1.10 or earlier. Contact the developer for patch status and in the absence of fixes, consider disabling or replacing the theme as a temporary measure. Check access logs for suspicious activity, PHP deserialization errors, or PHP object injection attempts in the past hours.