{"id":"CVE-2026-112847","published":"2026-10-23T13:17:06Z","modified":"2026-10-24T15:16:59Z","title":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…","vendor":"ThemeREX","product":"ZenSoul","tier":"core","eol":null,"description":{"text":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.","provenance":"source","from":"NVD"},"summary":{"text":"The ThemeREX ZenSoul theme (zensoul) contains a deserialization of untrusted data flaw, classified as CWE-502, which permits PHP object injection. An attacker who can reach the affected component over the network with no authentication or user interaction can supply crafted serialized input to inject objects, and the vendor advisory describes the affected range as all versions through 1.13.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:07Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00313,"percentile":0.24217,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":5,"pulses":[{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae0ba8e2d29f6aa1bfe6f11","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adf68ca1522e5424ef6b0c7","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adb7421f0eaee440740fbf3","created":"2026-10-23"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/zensoul/vulnerability/wordpress-zensoul-theme-1-13-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-108952","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108952","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112847","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.84,"detail":"percentile 0.2422"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}