CVE-2026-104747: WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The vulnerability is unauthenticated and requires no user interaction.

Q: How difficult is exploitation and what could a successful attack impact?

The attack vector is network-accessible, but the CVSS vector rates attack complexity as high. A successful exploit could have high impact on confidentiality, integrity, and availability, with scope unchanged.

Q: Which installations are in scope for remediation?

WordPress sites using the Haaken theme at version 1.5 or earlier are affected according to the provided information.

Published Oct 6, 2026

Updated

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Affected Software

1 affected component

WordPress Haaken theme<=1.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Haaken - Fashion Store WordPress Theme to a version that resolves this vulnerability.
Fixed in 1.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account or user interaction?

No. The vulnerability is unauthenticated and requires no user interaction.

How difficult is exploitation and what could a successful attack impact?

The attack vector is network-accessible, but the CVSS vector rates attack complexity as high. A successful exploit could have high impact on confidentiality, integrity, and availability, with scope unchanged.

Which installations are in scope for remediation?

WordPress sites using the Haaken theme at version 1.5 or earlier are affected according to the provided information.

CVE-2026-104747: WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated WordPress account or user interaction?

How difficult is exploitation and what could a successful attack impact?

Which installations are in scope for remediation?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated WordPress account or user interaction?

How difficult is exploitation and what could a successful attack impact?

Which installations are in scope for remediation?