---
id: "CVE-2026-112846"
kind: "vulnerability"
aliases: ["CVE-2026-112846"]
title: "WordPress Save Life theme: unauthenticated PHP object injection through 1.2.14"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "other"
products: [{"name": "save-life", "fixed": [], "affected": "<= 1.2.14", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["other", "php", "php-object-injection", "self-hosted", "themerex", "unauthenticated", "wordpress", "wordpress-theme"]
not_affected_if: ["save-life-not-installed", "theme-version-above-1.2.14"]
published_at: "2026-10-23T13:17:06+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112846", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:04:57+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112846", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# WordPress Save Life theme: unauthenticated PHP object injection through 1.2.14

The Save Life WordPress theme by ThemeREX deserializes untrusted input, which allows PHP object injection. Per the sources, an unauthenticated attacker can trigger it, and the worst case is code execution on the site server depending on available gadget chains.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:save-life affected <= 1.2.14 fixed ?

## How to check

Check the installed theme version in WordPress Admin > Appearance > Themes, or run: wp theme list --name=save-life --field=version

## Fix

Update the save-life theme to a version newer than 1.2.14; if none is available, remove or replace the theme. Fixed version: unknown

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112846
- 2026-10-23T22:04:57+00:00 analyst — CVE record and Patchstack (21 Oct 2026): unauthenticated PHP object injection, CVSS 9.8, Save Life <= 1.2.14. Patchstack says no official patch exists. I did not read the ThemeREX changelog. No PoC or exploitation found. No X or HN search done.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112846

## Documents

- [advisory] Patchstack: Save Life <= 1.2.14 PHP Object Injection https://patchstack.com/database/wordpress/theme/save-life/vulnerability/wordpress-save-life-theme-1-2-14-php-object-injection-vulnerability
- [describes] CVE record CVE-2026-112846 https://www.cve.org/CVERecord?id=CVE-2026-112846

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_