{"id":"CVE-2026-112853","kind":"vulnerability","aliases":["CVE-2026-112853"],"related":[],"title":"Hallelujah WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects","description":"Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.","summary":"The Hallelujah WordPress theme by axiomthemes unserializes untrusted data, so object injection is possible. The sources rate it critical (CVSS 9.8) and say it needs no login, so an attacker may be able to run code or take over the site.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"hallelujah","fixed":[],"affected":"<= 1.1.1","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["axiomthemes","hallelujah-theme","package","php-object-injection","self-hosted","unauthenticated","wordpress"],"not_affected_if":["theme-not-installed","version-above-1.1.1"],"how_to_check":"Check the installed theme version in the WordPress admin under Appearance > Themes, or in style.css of the hallelujah theme directory; versions through 1.1.1 are affected.","fix":"Update the Hallelujah theme to a version newer than 1.1.1 or remove it; the sources do not name a fixed version, so check the vendor for the patched release.\nRotate site secrets and review admin accounts if the theme was exposed while vulnerable.","status":"open","published_at":"2026-10-23T13:17:06+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:17+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:31:17Z","model":"claude-haiku-5-5","output":{"fix":"Update the Hallelujah theme to a version newer than 1.1.1 or remove it; the sources do not name a fixed version, so check the vendor for the patched release.\nRotate site secrets and review admin accounts if the theme was exposed while vulnerable.","reach":"internet","title":"Hallelujah WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects","impact":"high","summary":"The Hallelujah WordPress theme by axiomthemes unserializes untrusted data, so object injection is possible. The sources rate it critical (CVSS 9.8) and say it needs no login, so an attacker may be able to run code or take over the site.","category":"package","who_cares":["wordpress","hallelujah-theme","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker may run code on the WordPress server","analyst_note":"Confirm the fixed version and the vulnerable entry point in the vendor advisory or NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-112853); sources only give 'through 1.1.1'.","how_to_check":"Check the installed theme version in the WordPress admin under Appearance > Themes, or in style.css of the hallelujah theme directory; versions through 1.1.1 are affected.","needs_analyst":true,"not_affected_if":["theme-not-installed","version-above-1.1.1"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000561,"input_tokens":2954,"output_tokens":532,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check NVD and the axiomthemes/WordPress vendor advisory for a fixed version after 1.1.1, the vulnerable entry point, and whether authentication is required.","search":"'-112853':13A,16A '-2026':12A,15A '1.1.1':91C '9.8':52B 'abl':64B 'affect':86C 'allow':82C 'attack':61B 'axiomthem':18B,37B,79C 'code':67B 'critic':50B 'cve':11A,14A 'cvss':51B 'data':40B,76C 'deseri':5A,73C 'hallelujah':1A,17A,20B,33B,80C,81C,87C 'hallelujah-them':19B 'host':29B 'inject':9A,26B,43B 'injection.this':84C 'issu':85C 'let':6A 'login':58B 'may':62B 'n/a':89C 'need':56B 'object':10A,25B,42B,83C 'packag':22B 'php':24B 'php-object-inject':23B 'possibl':45B 'rate':48B 'run':66B 'say':54B 'self':28B 'self-host':27B 'site':72B 'sourc':47B 'take':69B 'theme':3A,21B,35B 'unauthent':7A,30B 'unsaf':4A 'unseri':38B 'untrust':39B,75C 'visitor':8A 'vulner':77C 'wordpress':2A,31B,34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112853","severity":null,"published_at":"2026-10-23T13:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112853:162","url":null,"severity":null,"published_at":"2026-10-23T22:03:55+00:00","modified_at":"2026-10-23T22:03:55+00:00","first_seen_at":"2026-10-23T22:03:55+00:00","fetched_at":"2026-10-23T22:03:55+00:00","note":"Patchstack advisory (CNA): Hallelujah <= 1.1.1 PHP object injection, CVSS 9.8 PR:N (unauthenticated per vector); no official patch as of 2026-10-23; not marked exploited, no PoC found. Exact entry point and gadget chain not published; X/social not searched."},{"source":"epss","external_id":"CVE-2026-112853","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112853","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1300,"url":"https://patchstack.com/database/wordpress/theme/hallelujah/vulnerability/wordpress-hallelujah-theme-1-1-1-php-object-injection-vulnerability","title":"Patchstack: WordPress Hallelujah Theme <= 1.1.1 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1301,"url":"https://cve.report/CVE-2026-112853","title":"CVE.report CVE-2026-112853","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}