Live › vulnerability › CVE-2026-112852
Go to dashboardThe ThemeREX Helion theme deserializes untrusted input, which lets an attacker inject PHP objects. Sources do not say what code path or what an attacker can do after injection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Helion theme from ThemeREX at version or earlier are affected. Sites that do not use this theme can skip it. The sources do not say whether the flaw needs a logged-in user or a particular setting.
1.1.12No product ranges from the sources yet.
1.1.12Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
This page as .md · .json · in your agent: get_signal("CVE-2026-112852")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.