---
id: "CVE-2026-112851"
kind: "vulnerability"
aliases: ["CVE-2026-112851"]
title: "HotLock WordPress theme: object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "HotLock", "fixed": [], "affected": "<= 1.3.9", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["hotlock", "other", "package", "php-object-injection", "self-hosted", "themerex", "wordpress"]
not_affected_if: ["managed-hosting", "theme-not-installed"]
published_at: "2026-10-23T13:17:06+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112851", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:03:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:36:04+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112851", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# HotLock WordPress theme: object injection lets attackers run code

The HotLock WordPress theme by ThemeREX deserializes untrusted data in versions up to 1.3.9. Patchstack lists it as exploitable by unauthenticated attackers (CVSS 9.8) and says no official patch exists. A remote attacker can inject PHP objects, which can lead to code execution depending on gadget chains on the site. No exploitation or public PoC is known yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:HotLock affected <= 1.3.9 fixed ?

## How to check

In WP admin go to Appearance > Themes and check the HotLock version, or read Version: in wp-content/themes/hotlock/style.css, or run wp theme list. 1.3.9 or lower is affected.

## Fix

No official patch per Patchstack as of 2026-10-21. ThemeREX lists 1.4.6 as current, but no source confirms it fixes this CVE; ask the vendor. Until confirmed, deactivate or replace the theme, or apply a WAF or Patchstack virtual patch.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112851
- 2026-10-23T22:03:51+00:00 analyst — Patchstack (disclosed 21 Oct 2026) lists HotLock <= 1.3.9 vulnerable with no official patch; CVSS 3.1 9.8 (AV:N/PR:N, unauthenticated). Vendor page shows 1.4.6 (updated 2026-03-18), but no source says 1.4.6 fixes it, so the fixed version is unknown. Not in KEV; no PoC or exploitation found. X and discussion not searched.
- 2026-10-23T22:36:04+00:00 analyst — Re-read Patchstack page: privilege required is Unauthenticated, no official patch listed, mitigation rule available, no PoC or exploitation. Fixed version still unknown; ThemeREX page shows 1.4.6 but no source ties it to this CVE. Restored how-to-check, which the last triage pass had cleared.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112851

## Documents

- [advisory] Patchstack: HotLock <= 1.3.9 PHP Object Injection https://patchstack.com/database/wordpress/theme/hotlock/vulnerability/wordpress-hotlock-theme-1-3-9-php-object-injection-vulnerability
- [describes] HotLock theme page (ThemeREX) - current version 1.4.6 https://themerex.net/downloads/hotlock-locksmith-security-systems/
- [mentions] Rapid7 CVE-2026-112851 https://www.rapid7.com/db/vulnerabilities/cve-2026-112851/

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_