External risk intelligence

PHP Object Injection in A.Williams Theme Versions Prior to 1.3.2

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65572

The vulnerability affects a WordPress theme, which by nature is a web-based component. These are typically deployed as part of public-facing web applications, making the attack surface internet-reachable in common deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in a widely used type of web technology that could allow unauthorized access and control of systems. This vulnerability, related to how data is handled within certain applications, presents a significant risk if exploited. The primary concern is to determine if our environment is affected and to understand the potential implications.

Unauthenticated code injection in web technology.
Matters if your web applications use this tech.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data over the network to a vulnerable PHP application. This could lead to the execution of arbitrary PHP code, potentially allowing the attacker to take full control of the affected system.

Unauthenticated network access required.
Triggered by injecting serialized PHP objects.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

The unauthenticated PHP object injection vulnerability in A.Williams themes could allow an attacker to inject and execute arbitrary code. This could lead to the full compromise of the affected website and its underlying server, when supported by the advisory.

Website content and user data at risk.
Remote code execution through serialized data.
Complete website takeover possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in an unauthenticated PHP object injection within a WordPress theme requires immediate attention. Ownership likely falls to the application or platform team responsible for the WordPress instance, with collaboration from the security team for exposure assessment. The first practical step is to identify all deployments of the affected theme, confirm its reachability and business criticality, and then prioritize remediation based on risk.

Application owners should lead remediation efforts.
Verify theme installation and exposure.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the A.Williams theme?

A.Williams is a WordPress theme used to determine the visual design and layout of a website. Themes often include custom PHP code to handle dynamic content, styling, and specific features, which means they run directly on your web server and interact with your site's data.

What does PHP object injection mean for CVE-2026-65572?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. It happens when the software takes user-provided data that has been turned into a complex object and processes it without proper checks. An attacker can craft this data to manipulate the application's logic, potentially leading to unauthorized code execution.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially prepared, serialized PHP object to the application over the network. The bug does not require the attacker to have an account or log in. It is only triggered if the application actively processes the malicious input provided by the attacker.

Is my website at risk from CVE-2026-65572?

According to Halo Surface Signal, because this is a WordPress theme, it is frequently used on public-facing websites. If your instance is accessible over the internet, it is considered reachable, increasing the likelihood that it could be targeted compared to an internal, restricted application.

How should I respond to this threat?

Start by identifying every instance of the A.Williams theme running in your environment. Once you have a list of affected sites, evaluate their business importance and internet connectivity. Prioritize updating these installations to version 1.3.2 or higher, or remove the theme if it is no longer required.

References

patchstack.com/database/wordpress/theme/alisha-williams/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.