CVE-2026-112851

Summary

The HotLock plugin before 1.3.9 suffers from unsafe deserialization (CWE-502), allowing an unauthenticated remote attacker to inject malicious objects and potentially execute arbitrary code by sending a crafted serialized payload.

Exploitability

Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions; the flaw exists in a network-accessible deserialization endpoint.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data theft, and service disruption due to the CVSS 9.8 severity and lack of pre-authentication barriers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade HotLock to version 1.3.10 or later, as this is the fixed version that addresses the deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.