{"id":"CVE-2026-112846","kind":"vulnerability","aliases":["CVE-2026-112846"],"related":[],"title":"WordPress Save Life theme: unauthenticated PHP object injection through 1.2.14","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.","summary":"The Save Life WordPress theme by ThemeREX deserializes untrusted input, which allows PHP object injection. Per the sources, an unauthenticated attacker can trigger it, and the worst case is code execution on the site server depending on available gadget chains.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"save-life","fixed":[],"affected":"<= 1.2.14","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["other","php","php-object-injection","self-hosted","themerex","unauthenticated","wordpress","wordpress-theme"],"not_affected_if":["save-life-not-installed","theme-version-above-1.2.14"],"how_to_check":"Check the installed theme version in WordPress Admin > Appearance > Themes, or run: wp theme list --name=save-life --field=version","fix":"Update the save-life theme to a version newer than 1.2.14; if none is available, remove or replace the theme. Fixed version: unknown","status":"open","published_at":"2026-10-23T13:17:06+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:21+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:31:21Z","model":"claude-haiku-5-5","output":{"fix":"Update the save-life theme to a version newer than 1.2.14; if none is available, remove or replace the theme. Fixed version: unknown","reach":"internet","title":"WordPress Save Life theme: unauthenticated PHP object injection through 1.2.14","impact":"high","summary":"The Save Life WordPress theme by ThemeREX deserializes untrusted input, which allows PHP object injection. Per the sources, an unauthenticated attacker can trigger it, and the worst case is code execution on the site server depending on available gadget chains.","category":"other","who_cares":["wordpress","wordpress-theme","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Code may run on the server through PHP object injection gadgets.","analyst_note":"Confirm the fixed version and whether the vulnerable endpoint needs a specific setting; see https://nvd.nist.gov/vuln/detail/CVE-2026-112846.","how_to_check":"Check the installed theme version in WordPress Admin > Appearance > Themes, or run: wp theme list --name=save-life --field=version","needs_analyst":true,"not_affected_if":["save-life-not-installed","theme-version-above-1.2.14"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000526,"input_tokens":2944,"output_tokens":463,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the flaw is unauthenticated and reachable remotely, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112846 and the ThemeREX vendor changelog.","search":"'-112846':13A,16A '-2026':12A,15A '1.2.14':10A,98C 'affect':92C 'allow':46B,88C 'attack':55B 'avail':72B 'case':62B 'chain':74B 'code':64B 'cve':11A,14A 'data':78C 'depend':70B 'deseri':42B,75C 'execut':65B 'gadget':73B 'group':82C 'host':28B 'inject':8A,25B,49B 'injection.this':90C 'input':44B 'issu':91C 'life':3A,19A,37B,84C,87C,94C 'n/a':96C 'object':7A,24B,48B,89C 'per':50B 'php':6A,21B,23B,47B 'php-object-inject':22B 'save':2A,18A,36B,83C,86C,93C 'save-lif':85C 'save-life':17A 'self':27B 'self-host':26B 'server':69B 'site':68B 'sourc':52B 'theme':4A,34B,39B 'themerex':29B,41B,81C 'trigger':57B 'unauthent':5A,30B,54B 'untrust':43B,77C 'vulner':79C 'wordpress':1A,31B,33B,38B 'wordpress-them':32B 'worst':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112846","severity":null,"published_at":"2026-10-23T13:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112846:167","url":null,"severity":null,"published_at":"2026-10-23T22:04:57+00:00","modified_at":"2026-10-23T22:04:57+00:00","first_seen_at":"2026-10-23T22:04:57+00:00","fetched_at":"2026-10-23T22:04:57+00:00","note":"CVE record and Patchstack (21 Oct 2026): unauthenticated PHP object injection, CVSS 9.8, Save Life <= 1.2.14. Patchstack says no official patch exists. I did not read the ThemeREX changelog. No PoC or exploitation found. No X or HN search done."},{"source":"epss","external_id":"CVE-2026-112846","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112846","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1302,"url":"https://patchstack.com/database/wordpress/theme/save-life/vulnerability/wordpress-save-life-theme-1-2-14-php-object-injection-vulnerability","title":"Patchstack: Save Life <= 1.2.14 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1303,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112846","title":"CVE record CVE-2026-112846","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}