CVE-2026-54860

Name of the Vulnerable Software and Affected Versions Ozisti versions prior to 1.1.11

Description Ozisti, an Augmented Reality WooCommerce Theme for WordPress, allows unauthenticated attackers to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to achieve code execution) exists within the theme, the presence of a POP chain in other installed plugins or themes could enable an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 1.1.10.