CVE-2026-8365

The flaw

The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient

What to do

Review advisory and patch per vendor guidance.

References