ThemeREX ZenSoul WordPress theme: PHP Object Injection via untrusted deserialization
Summary
The ZenSoul WordPress theme from ThemeREX, versions up to and including 1.13, deserializes untrusted data without proper validation. An unauthenticated remote attacker can inject PHP objects, which may allow manipulation of server-side processing and, depending on other code loaded on the site, harmful actions on the server. Patchstack rates the issue as high priority with CVSS 9.8, but no official patch is confirmed.
Affected
- ThemeREX ZenSoul WordPress theme, versions up to and including 1.13 (earliest affected version unknown)
- Versions above 1.13 are not confirmed as fixed or unaffected in the sources reviewed
Fixed in
Unknown. Patchstack states that no official patch is available. Sources conflict on current version numbers (ThemeForest lists 1.18.0), so verify the installed version and the vendor changelog.
Workaround
- Restrict public access to the affected site with a WAF or hosting-level controls until the issue is resolved
- Consider a virtual patch from a WAF or security vendor (Patchstack offers one as a commercial option, not an official ThemeREX fix)
- Review other installed plugins and themes for dangerous deserialization gadgets
- Verify that any change does not break the site and take a backup first
Exploitation
- Exploited in the wild: not confirmed
- Public proof of concept: none found in the sources checked
- Patchstack expects exploitation (forecast, not observed)
- EPSS: 0.00313 (low predicted probability)
- Unauthenticated and network-reachable, no user interaction required
Our recommendation
- Inventory all WordPress sites and check the installed ZenSoul version in the theme style header or the WordPress admin
- For any site on version 1.13 or lower, or with an unknown version: restrict exposure and plan replacement with a maintained theme or a verified update
- Monitor the Patchstack entry and the ThemeREX ThemeForest changelog for a fixed release
- Review web server logs for unusual POST requests and keep backups before making changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- NVD/CNA record (Vulners) vulners.com
- HOL Guard entry hol.org
- VulDB entry vuldb.com
- ThemeREX ZenSoul product page themerex.net
- ThemeForest ZenSoul listing themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:51.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.