The HotLock WordPress theme contains a flaw where user‑controlled data is deserialized without proper validation, enabling PHP object injection. This flaw permits an attacker to instantiate arbitrary PHP objects during deserialization, which can lead to remote code execution and full control of the compromised WordPress site. The vulnerability is identified as CWE‑502 and receives a CVSS score of 9.8. Based on the description, it is inferred that attackers can exploit the flaw by sending crafted serialized input to the theme’s data handling functions, typically via query parameters or form submissions.

WordPress installations that use the HotLock theme, versions 1.0 through 1.3.9. All releases up to and including 1.3.9 are vulnerable, so any site that has not upgraded beyond that version is potentially compromised.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, so the current likelihood cannot be quantified. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted serialized data to the theme, which is plausible through exposed input fields. With successful exploitation, an attacker can execute arbitrary PHP code, compromising site integrity and confidentiality.