CVE-2026-112853

CVE-2026-112853 · WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

CVSS 9.8 · Critical · EPSS 0.4%

Published: 2026-10-23T13:00:18.338Z
Updated: 2026-10-23T14:59:06.317Z

Affected products and versions

hallelujah
Versions
- ≥ 0, ≤ 1.1.1: Affected (custom)
No fix published

Original sources

https://patchstack.com/database/wordpress/theme/hallelujah/vulnerability/wordpress-hallelujah-theme-1-1-1-php-object-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-112853

Check your server →