Hallelujah
Monthly
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.