Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112851updated 25 Oct 2026, 17:05 UTC

HotLock WordPress theme allows attackers to inject malicious objects

Attackers may be able to send specially crafted data to the HotLock website component, which could let them run harmful code or take control of the site. Think of it as a lock whose key-reading mechanism can be tricked.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted serialized data
  2. 2Website requestMalicious input reaches the site
  3. 3HotLock pluginUnserializes untrusted input without checks
  4. 4Object injectionAttacker-chosen objects are created
  5. 5Code executionInjected objects trigger harmful actions
  6. ResultAttacker may control the website server

What happened

A deserialization of untrusted data flaw (PHP object injection) affects ThemeREX HotLock through version 1.3.9, letting crafted input be unserialized into attacker-controlled objects.

Why it is dangerous: A successful attack could lead to remote code execution or full compromise of the website and its data. Any site running the affected HotLock version is at risk.

Are you affected?

You are affected if your site runs ThemeREX HotLock version 1.3.9 or earlier.

ThemeREX Group HotLock (hotlock): all versions through 1.3.9

What to do

  1. Check whether HotLock is installed and note its version
  2. Update HotLock to a version newer than 1.3.9 once the vendor releases one
  3. If no fixed version is available, deactivate and remove HotLock until a patch is released
  4. Monitor the vendor and advisory GHSA-qgpf-hhcm-qq72 for updates

Timeline

  1. 23 Oct 2026, 13:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 13:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:05 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112851 · GHSA-qgpf-hhcm-qq72
CVSS
9.8 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 13:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

HotLock WordPress theme allows attackers to inject malicious objects · Zero Radar