CVE-2026-112851EUVD-2026-108950GHSA-QGPF-HHCM-QQ72
WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The HotLock theme for WordPress, developed by ThemeREX Group, is affected by this vulnerability. An attacker could exploit the flaw to inject malicious PHP objects through untrusted data, which could potentially lead to code execution or other serious compromise of the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
Affected versions
- hotlock
through 1.3.9