Live › vulnerability › CVE-2026-112846
Go to dashboardThe Save Life WordPress theme by ThemeREX deserializes untrusted input, which allows PHP object injection. Per the sources, an unauthenticated attacker can trigger it, and the worst case is code execution on the site server depending on available gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| save-life | wordpress-theme | <= 1.2.14 | – |
Check the installed theme version in WordPress Admin > Appearance > Themes, or run: wp theme list --name=save-life --field=version
1.2.14; if none is available, remove or replace the themeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
This page as .md · .json · in your agent: get_signal("CVE-2026-112846")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.