HotLock CVE-2026-112851

Exploitation requires reaching a HotLock theme code path that deserializes attacker-supplied data and the presence of a usable PHP object-injection gadget chain (in the theme, WordPress core, or co-installed plugins) to achieve meaningful impact; the specific feature, parameter, or endpoint that performs the deserialization is not described in the available sources. The affected scope is HotLock versions up to and including 1.3.9; no fixed version is identified, so no upgrade target can be confirmed. Limiting factors: impact depends on an exploitable gadget being loadable in the target site's PHP stack, and the unauthenticated nature is asserted only by the supplied CVSS vector and should be confirmed against the Patchstack advisory.

Signals point toward high priority but rest on limited sourcing. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, and the vuln.today decision label is act_now, which argues against treating this as a paper-tiger high score. However, several corroborating signals are absent: no EPSS probability is provided, the vulnerability is NOT listed in CISA KEV, and no public exploit or working PoC is referenced (the sole reference is the Patchstack database advisory, not exploit code). So the high CVSS reflects theoretical worst-case impact for a CWE-502 PHP object injection, but there is no evidence of active exploitation or wide-scale weaponization at this time. The PR:N (unauthenticated) assertion is carried from the supplied vector; the description itself does not state the privilege level or trigger path, so whether exploitation truly requires no authentication should be verified against the Patchstack advisory. Net: real enough to patch promptly given act_now and a 9.8 network-unauthenticated profile, but the elevated urgency is driven by severity and vendor prioritization rather than confirmed in-the-wild activity.

A remote attacker sends crafted, serialized PHP data to an entry point in the HotLock WordPress theme that unsafely deserializes untrusted input (CWE-502), instantiating attacker-controlled objects (PHP Object Injection). If a usable gadget chain is present in the theme or the surrounding WordPress/plugin stack, this can escalate to file operations or code execution in the site's context. No public exploit code is referenced, and the exact trigger is not described in the available sources.