---
id: "CVE-2026-112852"
kind: "vulnerability"
aliases: ["CVE-2026-112852"]
title: "Helion WordPress theme: untrusted data deserialization allows object injection"
severity: "high"
cvss: 8.1
epss: 0.00436
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["helion", "package", "themes", "wordpress"]
not_affected_if: ["theme-not-installed"]
published_at: "2026-10-23T13:17:06+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112852", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112852", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Helion WordPress theme: untrusted data deserialization allows object injection

The ThemeREX Helion theme deserializes untrusted input, which lets an attacker inject PHP objects. Sources do not say what code path or what an attacker can do after injection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Helion theme version in the theme stylesheet header or WordPress admin under Appearance > Themes
- unknown whether other checks apply

## Fix

- Move Helion to a version later than `1.1.12`
- unknown whether a patched version exists or what the vendor advises

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112852
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112852

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_