CVE-2026-112853EUVD-2026-108948GHSA-W38J-PRHV-7QFM
WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Hallelujah theme for WordPress is affected, and it could allow an attacker to inject malicious PHP objects by supplying untrusted serialized data, which may lead to code execution, data theft, or site compromise.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
Affected versions
- hallelujah
through 1.1.1