CVE-2026-56055

Name of the Vulnerable Software and Affected Versions RealHomes versions prior to 4.5.4

Description The RH - Real Estate WordPress Theme is susceptible to PHP Object Injection through the deserialization of untrusted input. This issue allows authenticated attackers with subscriber-level access or higher to inject a PHP Object. While no native POP chain (a sequence of gadgets used to achieve code execution) is present in the software, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 4.5.3.