CVE-2026-112853: Deserialization of Untrusted Data in axiomthemes Hallelujah

This vulnerability involves deserialization of untrusted data in the axiomthemes Hallelujah theme, affecting versions from initial release through 1.1.1. The flaw allows an attacker to perform object injection, which can lead to remote code execution or other severe impacts. The CVSS 3.1 score of 9.8 reflects its critical nature, with an attack vector over the network, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided at this time.

Successful exploitation can result in complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the affected theme if feasible to reduce exposure.