CVE-2026-112847: WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
Published Oct 23, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
Affected Software
1 affected component
ThemeREX ZenSoul<=1.13
Event History
Oct 23, 2026
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be treated as affected?
ThemeREX ZenSoul installations running version 1.13 or earlier should be treated as affected. The available data does not specify the earliest affected version.
2
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates network-reachable exploitation with no privileges required and no user interaction.
3
What is the potential impact of successful exploitation?
The vulnerability is rated critical with high potential impact to confidentiality, integrity, and availability.
4
Is a fixed version identified in the available information?
No fixed release is identified. The available data only states that versions through 1.13 are affected.