External risk intelligence

ZenSoul Theme Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-112847

This vulnerability affects a WordPress theme. WordPress themes are intended to be deployed as public-facing web applications, making the attack surface directly reachable via the internet as part of the standard web server request processing flow.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A deserialization vulnerability in the ThemeREX ZenSoul theme allows an attacker to inject malicious code. This could potentially lead to the execution of arbitrary code on systems running the affected theme, impacting its availability, integrity, and confidentiality. The main concern is confirming relevance and exposure.

Untrusted data can be injected into the theme.
It allows remote code execution in public-facing applications.
Confirm if this theme is used in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a vulnerable installation of the ZenSoul theme. This data would then be deserialized, leading to the injection of malicious objects. Successful exploitation could allow an attacker to execute arbitrary code on the server, compromise data, or disrupt service.

No special access required.
Triggered by unsanitized input.
Allows full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A deserialization vulnerability in the ZenSoul theme could allow an attacker to inject malicious objects into the system. This could potentially lead to the execution of arbitrary code when the theme processes untrusted data, impacting the integrity and availability of the affected service.

Theme data and system integrity are at risk.
Attackers could inject malicious objects via the web.
Compromised service behavior and data corruption may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This deserialization vulnerability in ZenSoul impacts systems using versions up to 1.13. The initial focus should be on identifying all instances of the affected theme, assessing their business criticality and external reachability, and then coordinating with the application owner or vendor management for remediation.

Application owners and vendor management should lead remediation.
Verify external accessibility of ZenSoul instances.
Plan remediation based on criticality and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ThemeREX ZenSoul theme?

ZenSoul is a WordPress theme designed by ThemeREX for building websites. Themes dictate the visual style and functional layout of a WordPress site. Like all themes for this platform, it processes user requests and data to render pages, which means it acts as a fundamental component of the website's software stack.

What does CVE-2026-112847 mean by object injection?

This is a deserialization of untrusted data vulnerability, classified as CWE-502. In simple terms, the theme takes data provided by a user and converts it back into complex programming objects without properly checking if that data is safe. An attacker can craft this data to force the application to create unintended objects, often leading to unauthorized code execution.

How is this ZenSoul vulnerability triggered?

The vulnerability is triggered when the theme processes unsanitized, malicious input sent via web requests. It does not require special user privileges or authentication to initiate. Simply viewing the site or interacting with standard theme features is not the trigger; the attacker must specifically supply the crafted payload to the theme's processing logic.

Why is this CVE concerning for internet-facing sites?

Halo Surface Signal indicates that because ZenSoul is a WordPress theme, it is typically deployed on public-facing web applications. Since the attack vector is network-based and requires no authentication, any instance reachable from the internet is directly accessible to external actors, significantly increasing the risk of compromise.

How do I respond if I use this ZenSoul version?

First, confirm if your environment runs ZenSoul versions 1.13 or earlier. If you find the theme, prioritize it based on its role and accessibility. Coordinate with your application team or the theme vendor to address the software flaw. Until a patch is applied, limit the theme's exposure or restrict access to the affected web services.

References

patchstack.com/database/wordpress/theme/zensoul/vulnerability/wordpr…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.