Is CVE-2026-112846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112846 being exploited in the wild.

How severe is CVE-2026-112846?

Critical severity, with a CVSS score of 9.8, published 23 October 2026.

Which products and versions are affected?

ThemeREX Group Save Life up to 1.2.14.

How is CVE-2026-112846 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112846?

Check whether you run ThemeREX Group Save Life at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112846: ThemeREX Save Life PHP object injection

CVE-2026-112846 · Severity: critical · CVSS 9.8 · Published 2026-10-23

Save Life is a WordPress theme that allows website administrators to build and customize sites. The vulnerability allows unauthenticated attackers to inject malicious code through PHP object manipulation, potentially leading to remote code execution and complete server compromise. Websites using this theme are at immediate risk of being exploited for data theft, malware deployment, or ransomware attacks.

Vendors: ThemeREX Group.

Quick answers

Is CVE-2026-112846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112846 being exploited in the wild.
How severe is CVE-2026-112846?: Critical severity, with a CVSS score of 9.8, published 23 October 2026.
Which products and versions are affected?: ThemeREX Group Save Life up to 1.2.14.
Is there a fix for CVE-2026-112846?: No fixed version is recorded yet. Until an official patch is released, apply web application firewall mitigation rules (such as those provided by Patchstack) to block exploitation attempts. Contact your hosting provider or web developer for assistance if you cannot immediately update or apply protections.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112846 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112846?: Check whether you run ThemeREX Group Save Life at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Until an official patch is released, apply web application firewall mitigation rules (such as those provided by Patchstack) to block exploitation attempts. Contact your hosting provider or web developer for assistance if you cannot immediately update or apply protections.</anigation> </invoke>

Technical details

This is a PHP object injection (deserialization of untrusted data) vulnerability in the Save Life WordPress theme affecting versions up to 1.2.14. The flaw allows unauthenticated attackers to inject arbitrary PHP objects that can lead to remote code execution when unserialized. There is currently no official patch available; mitigation via web application firewall rules is recommended as a temporary measure.

Affected products

ThemeREX Group Save Life up to 1.2.14

Timeline

2026-10-23: disclosed: Published on Patchstack
2026-10-21: advisory: Reported by johska

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.