{"id":"CVE-2026-112847","kind":"vulnerability","aliases":["CVE-2026-112847"],"related":[],"title":"ZenSoul WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects","description":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.","summary":"ZenSoul, a ThemeREX WordPress theme, up to and including 1.13 deserializes untrusted data without login (PHP object injection, CVSS 9.8). Patchstack lists no official patch, but the vendor changelog shows object-injection fixes in 1.14.0 and 1.17.0, and 1.18.0 is the current release. Patchstack expects mass exploitation; none is known yet.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"ZenSoul","fixed":[],"affected":"<= 1.13","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["other","package","php-object-injection","themerex","unauthenticated","wordpress","wordpress-theme","zensoul"],"not_affected_if":["zensoul-not-installed"],"how_to_check":"WordPress admin: Appearance > Themes, check ZenSoul's version. Or run: wp theme list. Or read 'Version:' in wp-content/themes/zensoul/style.css. 1.13 or lower is affected. Also check the bundled ThemeREX Addons (trx_addons) plugin, whose changelog lists related fixes.","fix":"Update ZenSoul to 1.18.0 (latest, ThemeREX changelog), via the ThemeREX Updater plugin or a fresh download from ThemeForest. 1.14.0 fixed a similar unserialize issue and 1.17.0 fixed one in trx_addons_decode_settings(), but ThemeREX does not name this CVE, so Patchstack still lists no patch. If you can't update, remove the theme or use a WAF rule.","status":"open","published_at":"2026-10-23T13:17:06+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:20+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:31:20Z","model":"claude-haiku-5-5","output":{"fix":"Update ZenSoul to a version later than 1.13; the fixed version is not stated in the sources.","reach":"internet","title":"ZenSoul WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects","impact":"high","summary":"The ZenSoul WordPress theme by ThemeREX deserializes untrusted data, which allows PHP object injection. Per the sources, an unauthenticated attacker can exploit this, and the CVSS score is 9.8 (critical).","category":"package","who_cares":["wordpress","wordpress-theme","zensoul"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker may run code or reach data via PHP object injection","analyst_note":"Find the fixed ZenSoul version and a vendor or NVD page with the vulnerable entry point and a detection method (https://nvd.nist.gov/vuln/detail/CVE-2026-112847).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["zensoul-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0005,"input_tokens":2952,"output_tokens":410,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed ZenSoul version and a vendor or NVD page with the vulnerable entry point and a detection method (https://nvd.nist.gov/vuln/detail/CVE-2026-112847).","search":"'-112847':13A,16A '-2026':12A,15A '1.13':40B,101C '1.14.0':66B '1.17.0':68B '1.18.0':70B '9.8':50B 'affect':96C 'allow':92C 'changelog':59B 'current':73B 'cve':11A,14A 'cvss':49B 'data':43B,86C 'deseri':5A,41B,83C 'expect':76B 'exploit':78B 'fix':64B 'includ':39B 'inject':9A,23B,48B,63B 'injection.this':94C 'issu':95C 'known':81B 'let':6A 'list':52B 'login':45B 'mass':77B 'n/a':99C 'none':79B 'object':10A,22B,47B,62B,93C 'object-inject':61B 'offici':54B 'packag':19B 'patch':55B 'patchstack':51B,75B 'php':21B,46B 'php-object-inject':20B 'releas':74B 'show':60B 'theme':3A,29B,35B 'themerex':24B,33B,89C 'unauthent':7A,25B 'unsaf':4A 'untrust':42B,85C 'vendor':58B 'visitor':8A 'vulner':87C 'without':44B 'wordpress':2A,26B,28B,34B 'wordpress-them':27B 'yet':82B 'zensoul':1A,17A,30B,31B,90C,91C,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112847","severity":null,"published_at":"2026-10-23T13:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112847:164","url":null,"severity":null,"published_at":"2026-10-23T22:03:56+00:00","modified_at":"2026-10-23T22:03:56+00:00","first_seen_at":"2026-10-23T22:03:56+00:00","fetched_at":"2026-10-23T22:03:56+00:00","note":"Patchstack (CNA) advisory 21 Oct 2026: WordPress theme ZenSoul <= 1.13, unauthenticated PHP object injection, CVSS 9.8, no official patch. Not in KEV, no public PoC or exploitation found (Patchstack says expected to be exploited). X/social not searched. cvefeed's 'update to 1.13 or later' is a boilerplate error, since 1.13 is the affected version."},{"source":"analyst","external_id":"CVE-2026-112847:261","url":null,"severity":null,"published_at":"2026-10-23T22:37:20+00:00","modified_at":"2026-10-23T22:37:20+00:00","first_seen_at":"2026-10-23T22:37:20+00:00","fetched_at":"2026-10-23T22:37:20+00:00","note":"New: ThemeREX changelog on ThemeForest shows releases after 1.13 with object-injection fixes: 1.14.0 (15 Apr 2026, unserialize of scheme_storage/skin options), 1.17.0 (9 Oct 2026, trx_addons_decode_settings()), latest 1.18.0. Neither entry cites the CVE, and Patchstack (21 Oct) still says no patch, so the exact fixing release is unconfirmed. Recommend 1.18.0. Still no PoC or exploitation known."},{"source":"epss","external_id":"CVE-2026-112847","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112847","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1297,"url":"https://patchstack.com/database/wordpress/theme/zensoul/vulnerability/wordpress-zensoul-theme-1-13-php-object-injection-vulnerability","title":"Patchstack: WordPress ZenSoul Theme <= 1.13 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1298,"url":"https://app.opencve.io/cve/CVE-2026-112847","title":"OpenCVE: CVE-2026-112847","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1536,"url":"https://themeforest.net/item/zensoul-spa-salon-wellness-wordpress-theme/49501821","title":"ThemeForest: ZenSoul changelog (vendor ThemeREX), v1.18.0","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}