Hallelujah WordPress theme: PHP Object Injection via untrusted deserialization
Summary
The Hallelujah WordPress theme by AxiomThemes up to and including version 1.1.1 contains a deserialization flaw (CWE-502) that allows PHP Object Injection. An unauthenticated remote attacker can send crafted data to a public site, which may let them manipulate application logic and, depending on the code present on the installation, potentially run harmful actions on the server. The CVSS score is 9.8 (critical), and Patchstack rates the priority as high.
Affected
- Hallelujah WordPress theme by AxiomThemes, versions up to and including 1.1.1
- Start of the affected range: unknown (listed as "n/a")
Fixed in
Unknown. No vendor advisory or fixed version has been confirmed.
Workaround
- No documented workaround is available.
- Patchstack reports a mitigation rule that blocks attacks until an official patch is available, if your hosting or security setup supports it.
Exploitation
- No public proof of concept found; VulDB states no exploit is available.
- Not marked as known exploited at the time of research.
- Patchstack and CISA SSVC assessment indicate automatable exploitation with total technical impact, and Patchstack expects mass exploitation.
- Exploitation requires no authentication and no user interaction.
Our recommendation
- Inventory all WordPress sites and check whether the Hallelujah theme is installed, active or inactive.
- Record the installed version; versions 1.1.1 and below are affected.
- Check the vendor and Patchstack for a confirmed fixed version and apply it as soon as available.
- If no fix is confirmed, remove the theme or restrict public access to affected sites.
- Review web server and application logs for unusual requests, and check for unexpected file or administrator account changes.
- Re-check the NVD and Patchstack records, as the NVD status is Deferred and details may change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry CVE-2026-112853 vuldb.com
- Vulners VulnCheck/Vulnrichment record vulners.com
- Vulners NVD record vulners.com
- HOL Guard CVE record hol.org
- CVE Threatint record cve.threatint.com
- AxiomThemes Hallelujah product page axiomthemes.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:52.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.