CVE-2026-112851
CriticalCVSS 9.8Summary
The HotLock WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects HotLock from n/a through 1.3.9.
Risk Assessment
Object injection may lead to unexpected code execution or data manipulation on the WordPress site. The risk applies to sites using the vulnerable theme.
Recommendation
Update the HotLock theme to a version later than 1.3.9 if available, or remove/disable the theme until a fix is released.
Related vulnerabilities
- CVE-2026-57116Critical
In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.
- CVE-2026-112859Critical
The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.
- CVE-2026-112858Critical
The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.
- CVE-2026-112857Critical
The Reprizo WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Reprizo from n/a through 1.0.8.
- CVE-2026-112856Critical
The Vagabonds WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Vagabonds from n/a through 1.3.10.
- CVE-2026-112855Critical
The Redy WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Redy from n/a through 1.3.5.
- CVE-2026-112854Critical
The Holistic Center WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Holistic Center from n/a through 1.2.6.
- CVE-2026-112853Critical
The Hallelujah WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Hallelujah from n/a through 1.1.1.
- CVE-2026-112848Critical
A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.
- CVE-2026-112847Critical
A deserialization of untrusted data vulnerability in the ThemeREX ZenSoul WordPress theme allows object injection. The issue affects ZenSoul from n/a through version 1.13.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS