CVE-2026-112852: WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Q: Which Helion installations are affected?

Helion versions through 1.1.12 are affected. The available data does not identify a first affected version or a fixed version.

Q: Can this be exploited remotely without an account or user interaction?

The CVSS vector indicates network-based exploitation with no privileges required and no user interaction required. Exploitation complexity is rated high.

Q: What impact could successful exploitation have?

The vulnerability is rated high severity with high confidentiality, integrity, and availability impact. Successful exploitation could therefore affect data confidentiality, modify data, and disrupt availability.

Published Oct 23, 2026

Updated

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

Affected Software

1 affected component

ThemeREX Group Helion<=1.1.12

Event History

Oct 23, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Helion installations are affected?

Helion versions through 1.1.12 are affected. The available data does not identify a first affected version or a fixed version.

Can this be exploited remotely without an account or user interaction?

The CVSS vector indicates network-based exploitation with no privileges required and no user interaction required. Exploitation complexity is rated high.

What impact could successful exploitation have?

The vulnerability is rated high severity with high confidentiality, integrity, and availability impact. Successful exploitation could therefore affect data confidentiality, modify data, and disrupt availability.

CVE-2026-112852: WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

Which Helion installations are affected?

Can this be exploited remotely without an account or user interaction?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which Helion installations are affected?

Can this be exploited remotely without an account or user interaction?

What impact could successful exploitation have?