---
id: "CVE-2026-112853"
kind: "vulnerability"
aliases: ["CVE-2026-112853"]
title: "Hallelujah WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "hallelujah", "fixed": [], "affected": "<= 1.1.1", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["axiomthemes", "hallelujah-theme", "package", "php-object-injection", "self-hosted", "unauthenticated", "wordpress"]
not_affected_if: ["theme-not-installed", "version-above-1.1.1"]
published_at: "2026-10-23T13:17:06+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112853", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:03:55+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112853", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Hallelujah WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects

The Hallelujah WordPress theme by axiomthemes unserializes untrusted data, so object injection is possible. The sources rate it critical (CVSS 9.8) and say it needs no login, so an attacker may be able to run code or take over the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:hallelujah affected <= 1.1.1 fixed ?

## How to check

Check the installed theme version in the WordPress admin under Appearance > Themes, or in style.css of the hallelujah theme directory; versions through 1.1.1 are affected.

## Fix

Update the Hallelujah theme to a version newer than 1.1.1 or remove it; the sources do not name a fixed version, so check the vendor for the patched release.
Rotate site secrets and review admin accounts if the theme was exposed while vulnerable.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112853
- 2026-10-23T22:03:55+00:00 analyst — Patchstack advisory (CNA): Hallelujah <= 1.1.1 PHP object injection, CVSS 9.8 PR:N (unauthenticated per vector); no official patch as of 2026-10-23; not marked exploited, no PoC found. Exact entry point and gadget chain not published; X/social not searched.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112853

## Documents

- [advisory] Patchstack: WordPress Hallelujah Theme <= 1.1.1 PHP Object Injection https://patchstack.com/database/wordpress/theme/hallelujah/vulnerability/wordpress-hallelujah-theme-1-1-1-php-object-injection-vulnerability
- [describes] CVE.report CVE-2026-112853 https://cve.report/CVE-2026-112853

## From the sources

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_