Save Life WordPress theme: PHP object injection via untrusted data

Summary

The Save Life WordPress theme by ThemeREX up to and including version 1.2.14 deserializes untrusted data, which allows PHP object injection. An unauthenticated remote attacker can manipulate how the website processes data and may run harmful actions on the server, with a CVSS score of 9.8. No vendor patch is available, and no confirmed exploitation or public proof of concept was found at the time of writing.

Affected

• Save Life WordPress theme by ThemeREX, versions up to and including 1.2.14
• Earliest affected version: Unknown.

Fixed in

• No fixed version available.

Workaround

• Deactivate the theme on internet-facing sites or replace it with a maintained theme (the only option that removes the risk).
• If the theme must stay live, place a web application firewall or virtual patch in front of it, for example Patchstack mitigation.
• Restrict access to administrator areas.
• Check whether custom code or plugins call unserialize() on user-controlled input.

Exploitation

• Known exploitation: Not confirmed.
• Patchstack expects exploitation and rates the issue as highly dangerous, but this is a prediction, not an observed attack.
• Public proof of concept: None found.
• Required privilege: None (unauthenticated).

Our recommendation

• Treat this as urgent if the theme runs on a public website.
• Check immediately whether the theme is in use; if so, deactivate it or replace it with a maintained theme.
• If it must remain live, apply a web application firewall or virtual patch and restrict admin access.
• Take a full backup and review administrator accounts and file changes, as compromise may already have occurred.
• Re-check Patchstack and NVD for a fix or exploitation updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-112846 patchstack.com
• NVD record via Vulners vulners.com
• HOL Guard CVE entry hol.org
• ThemeForest product page themeforest.net
• OWASP PHP Object Injection community.owasp.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:50.