Haaken
Monthly
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.