---
id: "CVE-2026-112847"
kind: "vulnerability"
aliases: ["CVE-2026-112847"]
title: "ZenSoul WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "ZenSoul", "fixed": [], "affected": "<= 1.13", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["other", "package", "php-object-injection", "themerex", "unauthenticated", "wordpress", "wordpress-theme", "zensoul"]
not_affected_if: ["zensoul-not-installed"]
published_at: "2026-10-23T13:17:06+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112847", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:03:56+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:37:20+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112847", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# ZenSoul WordPress theme: unsafe deserialization lets unauthenticated visitors inject objects

ZenSoul, a ThemeREX WordPress theme, up to and including 1.13 deserializes untrusted data without login (PHP object injection, CVSS 9.8). Patchstack lists no official patch, but the vendor changelog shows object-injection fixes in 1.14.0 and 1.17.0, and 1.18.0 is the current release. Patchstack expects mass exploitation; none is known yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:ZenSoul affected <= 1.13 fixed ?

## How to check

WordPress admin: Appearance > Themes, check ZenSoul's version. Or run: wp theme list. Or read 'Version:' in wp-content/themes/zensoul/style.css. 1.13 or lower is affected. Also check the bundled ThemeREX Addons (trx_addons) plugin, whose changelog lists related fixes.

## Fix

Update ZenSoul to 1.18.0 (latest, ThemeREX changelog), via the ThemeREX Updater plugin or a fresh download from ThemeForest. 1.14.0 fixed a similar unserialize issue and 1.17.0 fixed one in trx_addons_decode_settings(), but ThemeREX does not name this CVE, so Patchstack still lists no patch. If you can't update, remove the theme or use a WAF rule.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112847
- 2026-10-23T22:03:56+00:00 analyst — Patchstack (CNA) advisory 21 Oct 2026: WordPress theme ZenSoul <= 1.13, unauthenticated PHP object injection, CVSS 9.8, no official patch. Not in KEV, no public PoC or exploitation found (Patchstack says expected to be exploited). X/social not searched. cvefeed's 'update to 1.13 or later' is a boilerplate error, since 1.13 is the affected version.
- 2026-10-23T22:37:20+00:00 analyst — New: ThemeREX changelog on ThemeForest shows releases after 1.13 with object-injection fixes: 1.14.0 (15 Apr 2026, unserialize of scheme_storage/skin options), 1.17.0 (9 Oct 2026, trx_addons_decode_settings()), latest 1.18.0. Neither entry cites the CVE, and Patchstack (21 Oct) still says no patch, so the exact fixing release is unconfirmed. Recommend 1.18.0. Still no PoC or exploitation known.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112847

## Documents

- [advisory] Patchstack: WordPress ZenSoul Theme <= 1.13 PHP Object Injection https://patchstack.com/database/wordpress/theme/zensoul/vulnerability/wordpress-zensoul-theme-1-13-php-object-injection-vulnerability
- [fix] ThemeForest: ZenSoul changelog (vendor ThemeREX), v1.18.0 https://themeforest.net/item/zensoul-spa-salon-wellness-wordpress-theme/49501821
- [mentions] OpenCVE: CVE-2026-112847 https://app.opencve.io/cve/CVE-2026-112847

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_