CVE-2026-104747
Received Received - Intake

Unauthenticated PHP Object Injection in Haaken

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Patchstack

Description
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-104747
EUVD
EUVD-2026-93080

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Edge-Themes Haaken n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated PHP Object Injection vulnerability in the Haaken WordPress theme versions 1.5 and below. Attackers can exploit it to manipulate site data and execute harmful actions on the server without needing prior access.

Detection Guidance

Detecting this vulnerability requires checking if the Haaken WordPress theme version 1.5 or below is installed. Inspect your WordPress dashboard under Appearance > Themes for the theme version. Alternatively, use commands like 'grep -r "Haaken" /var/www/html/wp-content/themes/' in your server's theme directory to locate the theme and verify its version.

Impact Analysis

Exploitation could lead to unauthorized data access, site defacement, server compromise, or further malicious activities. Since it is unauthenticated, any unpatched site using Haaken <=1.5 is at immediate risk.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Immediately update the Haaken theme to version 1.6 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is completed. Remove or disable the vulnerable theme if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart