{"id":"CVE-2026-112851","kind":"vulnerability","aliases":["CVE-2026-112851"],"related":[],"title":"HotLock WordPress theme: object injection lets attackers run code","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.","summary":"The HotLock WordPress theme by ThemeREX deserializes untrusted data in versions up to 1.3.9. Patchstack lists it as exploitable by unauthenticated attackers (CVSS 9.8) and says no official patch exists. A remote attacker can inject PHP objects, which can lead to code execution depending on gadget chains on the site. No exploitation or public PoC is known yet.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"HotLock","fixed":[],"affected":"<= 1.3.9","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["hotlock","other","package","php-object-injection","self-hosted","themerex","wordpress"],"not_affected_if":["managed-hosting","theme-not-installed"],"how_to_check":"In WP admin go to Appearance > Themes and check the HotLock version, or read Version: in wp-content/themes/hotlock/style.css, or run wp theme list. 1.3.9 or lower is affected.","fix":"No official patch per Patchstack as of 2026-10-21. ThemeREX lists 1.4.6 as current, but no source confirms it fixes this CVE; ask the vendor. Until confirmed, deactivate or replace the theme, or apply a WAF or Patchstack virtual patch.","status":"open","published_at":"2026-10-23T13:17:06+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:18+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:31:18Z","model":"claude-haiku-5-5","output":{"fix":"Update HotLock to a version later than 1.3.9 once the vendor ships one; the sources do not name a fixed version.","reach":"internet","title":"HotLock WordPress theme: object injection lets attackers run code","impact":"high","summary":"The HotLock WordPress theme by ThemeREX deserializes untrusted data, which allows PHP object injection. A remote attacker may be able to trigger code execution or read and change data on the site.","category":"package","who_cares":["wordpress","hotlock","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the WordPress server and reads secrets","analyst_note":"Confirm the fixed version and whether unauthenticated access is needed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112851.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["theme-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000481,"input_tokens":2943,"output_tokens":374,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether unauthenticated access is needed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112851.","search":"'-112851':12A,15A '-2026':11A,14A '1.3.9':42B,106C '9.8':52B 'affect':101C 'allow':97C 'attack':7A,50B,61B 'chain':75B 'code':9A,70B 'cve':10A,13A 'cvss':51B 'data':37B,90C 'depend':72B 'deseri':35B,87C 'execut':71B 'exist':58B 'exploit':47B,80B 'gadget':74B 'group':94C 'host':26B 'hotlock':1A,16A,17B,30B,95C,96C,102C 'inject':5A,23B,63B 'injection.this':99C 'issu':100C 'known':85B 'lead':68B 'let':6A 'list':44B 'n/a':104C 'object':4A,22B,65B,98C 'offici':56B 'packag':19B 'patch':57B 'patchstack':43B 'php':21B,64B 'php-object-inject':20B 'poc':83B 'public':82B 'remot':60B 'run':8A 'say':54B 'self':25B 'self-host':24B 'site':78B 'theme':3A,32B 'themerex':27B,34B,93C 'unauthent':49B 'untrust':36B,89C 'version':39B 'vulner':91C 'wordpress':2A,28B,31B 'yet':86B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112851","severity":null,"published_at":"2026-10-23T13:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112851:163","url":null,"severity":null,"published_at":"2026-10-23T22:03:51+00:00","modified_at":"2026-10-23T22:03:51+00:00","first_seen_at":"2026-10-23T22:03:51+00:00","fetched_at":"2026-10-23T22:03:51+00:00","note":"Patchstack (disclosed 21 Oct 2026) lists HotLock <= 1.3.9 vulnerable with no official patch; CVSS 3.1 9.8 (AV:N/PR:N, unauthenticated). Vendor page shows 1.4.6 (updated 2026-03-18), but no source says 1.4.6 fixes it, so the fixed version is unknown. Not in KEV; no PoC or exploitation found. X and discussion not searched."},{"source":"analyst","external_id":"CVE-2026-112851:259","url":null,"severity":null,"published_at":"2026-10-23T22:36:04+00:00","modified_at":"2026-10-23T22:36:04+00:00","first_seen_at":"2026-10-23T22:36:04+00:00","fetched_at":"2026-10-23T22:36:04+00:00","note":"Re-read Patchstack page: privilege required is Unauthenticated, no official patch listed, mitigation rule available, no PoC or exploitation. Fixed version still unknown; ThemeREX page shows 1.4.6 but no source ties it to this CVE. Restored how-to-check, which the last triage pass had cleared."},{"source":"epss","external_id":"CVE-2026-112851","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112851","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1295,"url":"https://patchstack.com/database/wordpress/theme/hotlock/vulnerability/wordpress-hotlock-theme-1-3-9-php-object-injection-vulnerability","title":"Patchstack: HotLock <= 1.3.9 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1293,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-112851/","title":"Rapid7 CVE-2026-112851","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1294,"url":"https://themerex.net/downloads/hotlock-locksmith-security-systems/","title":"HotLock theme page (ThemeREX) - current version 1.4.6","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}