CVE-2026-112851: WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

Q: Which HotLock installations are affected?

The issue affects ThemeREX Group HotLock versions through 1.3.9. The available data does not identify a fixed version.

Q: Does exploitation require authentication or user interaction?

No. The vulnerability is rated with network attack vector, low attack complexity, no privileges required, and no user interaction required, indicating it can be exploited remotely without an authenticated account or victim action.

Q: What impact could successful exploitation have?

The severity vector indicates high impact to confidentiality, integrity, and availability. The vulnerability is classified as PHP object injection caused by deserialization of untrusted data.

Published Oct 23, 2026

Updated

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

Affected Software

1 affected component

ThemeREX Group HotLock<=1.3.9

Event History

Oct 23, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which HotLock installations are affected?

The issue affects ThemeREX Group HotLock versions through 1.3.9. The available data does not identify a fixed version.

Does exploitation require authentication or user interaction?

No. The vulnerability is rated with network attack vector, low attack complexity, no privileges required, and no user interaction required, indicating it can be exploited remotely without an authenticated account or victim action.

What impact could successful exploitation have?

The severity vector indicates high impact to confidentiality, integrity, and availability. The vulnerability is classified as PHP object injection caused by deserialization of untrusted data.

CVE-2026-112851: WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

Which HotLock installations are affected?

Does exploitation require authentication or user interaction?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which HotLock installations are affected?

Does exploitation require authentication or user interaction?

What impact could successful exploitation have?