ZenSoul WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects

1. NVD2026-10-23 21:57 UTC · published 2026-10-23 13:17 UTC · CVE-2026-112847
2. InfraStack analyst2026-10-23 22:03 UTC · published 2026-10-23 22:03 UTC
   “Patchstack (CNA) advisory 21 Oct 2026: WordPress theme ZenSoul <= 1.13, unauthenticated PHP object injection, CVSS 9.8, no official patch. Not in KEV, no public PoC or exploitation found (Patchstack says expected to be exploited). X/social not searched. cvefeed's 'update to 1.13 or later' is a boilerplate error, since 1.13 is the affected version.”
3. InfraStack analyst2026-10-23 22:37 UTC · published 2026-10-23 22:37 UTC
   “New: ThemeREX changelog on ThemeForest shows releases after 1.13 with object-injection fixes: 1.14.0 (15 Apr 2026, unserialize of scheme_storage/skin options), 1.17.0 (9 Oct 2026, trx_addons_decode_settings()), latest 1.18.0. Neither entry cites the CVE, and Patchstack (21 Oct) still says no patch, so the exact fixing release is unconfirmed. Recommend 1.18.0. Still no PoC or exploitation known.”
4. EPSS2026-10-25 12:38 UTC · CVE-2026-112847

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-112847 · 10-23 21:57
• EPSS: CVE-2026-112847 · 10-25 12:38
• Patchstack: WordPress ZenSoul Theme <= 1.13 PHP Object InjectionAdvisory · InfraStack analyst
• OpenCVE: CVE-2026-112847Mentions it · InfraStack analyst
• ThemeForest: ZenSoul changelog (vendor ThemeREX), v1.18.0Fix · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-112847")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.