Haaken WordPress theme: Unauthenticated PHP Object Injection
Summary
The Haaken WordPress theme (Fashion Store), versions up to and including 1.5, is affected by an unauthenticated PHP Object Injection flaw. An unauthenticated remote attacker can send crafted serialized data to the site, which may let them manipulate application logic and potentially run harmful actions on the server. Successful exploitation depends on the site having usable gadget chains and on an attacker overcoming high attack complexity.
Affected
- Haaken WordPress theme (Edge-Themes), versions <= 1.5
- Haaken Core plugin: affected versions unknown
Fixed in
- Theme version 1.6 is the likely fix according to the CNA advisory, but this is not confirmed by the vendor changelog or the primary advisory
- Haaken Core: fixed version unknown
Workaround
Unknown.
- If no update is possible, deactivate the theme on public sites.
Exploitation
- Not known exploited; not listed in CISA KEV
- CISA SSVC: exploitation none, automatable no, technical impact total
- EPSS score 0.26%
- No public proof of concept found
- Patchstack describes the vulnerability as expected to be exploited, based on its own risk assessment
Our recommendation
- Identify all WordPress sites using Haaken and record the theme and Haaken Core versions
- Update to the latest release, at least 1.6, and verify the fix against the Patchstack advisory
- If no fixed version can be confirmed, deactivate the theme on public sites
- Review public sites for signs of compromise
- Monitor the NVD and Patchstack entries, as NVD analysis is pending
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- ThemeForest Haaken Fashion Store changelog themeforest.net
- Hol.org security advisory hol.org
- VulDB CVE-2026-104747 vuldb.com
- Strix CVE-2026-104747 www.strix.ai
- SonarSource: WordPress object injection www.sonarsource.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:53.
Original description (NVD)
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.