HotLock WordPress theme: object injection lets attackers run code

1. NVD2026-10-23 21:57 UTC · published 2026-10-23 13:17 UTC · CVE-2026-112851
2. InfraStack analyst2026-10-23 22:03 UTC · published 2026-10-23 22:03 UTC
   “Patchstack (disclosed 21 Oct 2026) lists HotLock <= 1.3.9 vulnerable with no official patch; CVSS 3.1 9.8 (AV:N/PR:N, unauthenticated). Vendor page shows 1.4.6 (updated 2026-03-18), but no source says 1.4.6 fixes it, so the fixed version is unknown. Not in KEV; no PoC or exploitation found. X and discussion not searched.”
3. InfraStack analyst2026-10-23 22:36 UTC · published 2026-10-23 22:36 UTC
   “Re-read Patchstack page: privilege required is Unauthenticated, no official patch listed, mitigation rule available, no PoC or exploitation. Fixed version still unknown; ThemeREX page shows 1.4.6 but no source ties it to this CVE. Restored how-to-check, which the last triage pass had cleared.”

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-112851 · 10-23 21:57
• Patchstack: HotLock <= 1.3.9 PHP Object InjectionAdvisory · InfraStack analyst
• Rapid7 CVE-2026-112851Mentions it · InfraStack analyst
• HotLock theme page (ThemeREX) - current version 1.4.6Describes it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-112851")

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.