EUVD-2026-108948
GHSA-w38j-prhv-7qfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using Hallelujah theme
-
DeliverySend request with serialized PHP object
-
ExploitReach unsafe unserialize() sink
-
ExecutionInstantiate attacker-controlled objects
-
PersistTrigger POP gadget chain
-
ImpactCompromise site/execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the axiomthemes Hallelujah theme at version 1.1.1 or earlier. The description states only that the theme allows Object Injection via untrusted-data deserialization (CWE-502); it does not name the specific parameter, endpoint, or feature that reaches the unserialize() sink, so the exact trigger is not described in the available sources. A practical limiting factor inherent to PHP Object Injection is that meaningful impact (code execution, file write, etc.) typically requires a usable POP gadget chain present in the theme, WordPress core, or another installed component - whether such a chain is reachable here is not confirmed in the input. The CVSS vector indicates no authentication or user interaction is required. |
| Impact | All severity signals point the same direction but the exploitability picture is incomplete. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a remote, low-complexity, unauthenticated flaw with total impact, and the vuln.today Decision label is 'act_now,' reported by Patchstack. CWE-502 (deserialization of untrusted data leading to PHP Object Injection) is consistent with that scoring. However, no EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so the real-world exploitation signal is absent rather than negative. A critical caveat specific to this bug class: PHP Object Injection is only practically exploitable when a usable POP gadget chain is reachable in the theme or a co-installed plugin/WordPress core; the input does not state that such a chain exists or how the sink is reached, so the 9.8 represents worst-case reachability, not demonstrated unauthenticated RCE. Net: treat as a high-priority patch item because the product is a WordPress theme (internet-facing) and the Decision is act_now, but note the gap between the maximal CVSS score and the unconfirmed real-world exploitation state. |
| Exploit ScenarioDerived | A remote attacker submits a crafted request to a WordPress site running the Hallelujah theme (≤1.1.1) containing a maliciously serialized PHP object that reaches an unsafe unserialize() call. If a suitable gadget (POP) chain is present in the theme, WordPress, or another installed plugin, the deserialization triggers it, potentially leading to code execution, file operations, or data compromise. No confirmed working exploit was provided in the input; only a Patchstack database reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the immediate action is to check the Patchstack advisory entry (https://patchstack.com/database/wordpress/theme/hallelujah/vulnerability/wordpress-hallelujah-theme-1-1-1-php-object-injection-vulnerability?_s_id=cve) for an updated theme release and, if one appears, upgrade past 1.1.1 rather than assuming 1.1.1 itself is safe. Because the advisory does not disclose the parameter, endpoint or theme feature that reaches the deserialization sink, targeted virtual patching or WAF rule writing cannot be scoped from this data alone; the trade-off is that any rule would have to be broad (for example generic PHP object-injection signatures on request bodies), which carries false-positive risk against legitimate serialized WordPress data such as options and widget payloads. The most direct compensating control is to remove the exposure entirely by deactivating and uninstalling the Hallelujah theme where it is not business-critical, accepting the resulting loss of the site's current design and any theme-specific functionality; where the theme must stay live, restrict and monitor access to the site and treat unexplained file or option changes as potential post-exploitation, since a successful object injection with a viable gadget chain can lead to file writes or code execution. Confirming real exposure also requires inventorying co-installed plugins and themes for gadget chains that would make the injection exploitable, which is detection work rather than a fix and does not reduce the underlying vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-502, Deserialization of Untrusted Data, in a WordPress theme distributed by axiomthemes. PHP object injection occurs when attacker-influenced input is passed to unserialize() (or an equivalent phar/JSON-to-object path), letting the attacker control which classes are instantiated; the damage is then determined by magic methods such as __wakeup, __destruct or __toString in whatever classes are autoloadable, which is why a working exploit usually needs a POP gadget chain assembled from the vulnerable component plus WordPress core or other installed plugins and themes. CWE-502 describes the root cause class only; the supplied sources do not state how the vulnerable code path is triggered in this theme, which request parameter or feature reaches the sink, or whether the sink is reachable pre-authentication in practice. The CPE cpe:2.3:a:axiomthemes:hallelujah:*:*:*:*:*:*:*:* is an unbounded wildcard consistent with the advisory wording 'from n/a through 1.1.1', so every release up to and including 1.1.1 should be treated as affected. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network reachability, low attack complexity and no required authentication or interaction; these are severity metrics and do not by themselves describe the mechanism of the bug.
Know when Hallelujah gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WordPress theme reachable over the network with no stated auth or interaction (AV:N/AC:L/PR:N/UI:N); object injection can yield full code/data compromise, so C:H/I:H/A:H, though reachability of a gadget chain is unverified.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
Executive ViewAI
CVE-2026-112853 is a critical vulnerability in the axiomthemes Hallelujah WordPress theme (all versions up to 1.1.1) that could allow unauthenticated attackers to compromise website confidentiality, integrity, and availability. Any organization using this theme is exposed, and because the flaw may be exploited without credentials or user action, leadership should treat this as a high-priority risk requiring immediate attention.
Disable the Hallelujah theme immediately; use a WAF with virtual patching to block PHP object injection attempts; restrict access to the WordPress admin area and monitor for anomalous requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB