CVE-2026-22500: WordPress m2 Construction and Tools Store theme - PHP Object Injection via Deserialization (up to 1.1.2)
CVE-2026-22500 is a deserialization of untrusted data flaw (CWE-502) in the m2 Construction and Tools Store theme by axiomthemes, affecting versions up to and including 1.1.2. Patchstack scored it 9.8 (critical) and the record describes network-reachable attacks needing no privileges or user interaction. No fixed version and no confirmed exploitation appear in the sources consulted.
Overview
CVE-2026-22500 is a deserialization of untrusted data weakness (CWE-502) in the m2 Construction and Tools Store WordPress theme (m2-ce) from axiomthemes. The description says the issue allows Object Injection and affects the theme from an unspecified starting version through 1.1.2 inclusive. Patchstack is the CNA and published the record on 2026-03-25.
Impact
Object Injection through unsafe deserialization can let an attacker influence which objects the application creates and how they behave, which may lead to code execution, data access or denial of service depending on the application's available classes. The record's CVSS 3.1 vector indicates network attack, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact. The SSVC fields in the record mark the technical impact as total and the issue as automatable.
Affected products and versions
- Product: axiomthemes m2 | Construction and Tools Store (WordPress theme).
- Affected range: up to and including 1.1.2, per the record.
- Fixed version: none is listed in the record. The absence of a listed fix does not confirm that no fix exists.
Exploitation status
The CISA KEV entry is not listed, so no confirmed active exploitation can be stated from the record. The EPSS probability is 0.00529 with a percentile of 0.43941. No exploitation reports were found in the sources consulted.
Remediation and mitigation
- Check the theme version in your WordPress installation and treat 1.1.2 and earlier as vulnerable.
- Consult the Patchstack entry for the latest vendor guidance and any fixed release, since none is listed in the record.
- If no fix is available, consider disabling or replacing the theme until a patched version is confirmed.
- Restrict access to administrative and public endpoints where feasible, and keep WordPress core and plugins updated.
Detection guidance
- Inventory sites using the m2 theme and record the installed version.
- Review web server and application logs for unusual requests to theme components and unexpected serialized input.
- Monitor for unexpected file changes, new administrative accounts or outbound connections from the web server.
Limitations of the available information
The record does not state the exact vulnerable component, the entry point, the required conditions or the fixed version. The 'from n/a' wording in the description is unclear about the earliest affected release. The SSVC and EPSS values come from the record and were not independently verified here.
Frequently asked questions
What is CVE-2026-22500?
It is a deserialization of untrusted data flaw (CWE-502) in the m2 Construction and Tools Store WordPress theme by axiomthemes, which allows Object Injection in versions up to and including 1.1.2.
Is this vulnerability being actively exploited?
The record shows no CISA KEV listing, so active exploitation cannot be confirmed from it. No exploitation reports appear in the sources consulted.
Is there a fixed version?
No fixed version is listed in the record. Check the Patchstack entry for vendor guidance before deciding on remediation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.