Save Life CVE-2026-112846

The vulnerability is PHP object injection via deserialization of untrusted data in the ThemeREX Save Life theme (versions up to and including 1.2.14). The supplied CVSS vector is PR:N/UI:N, so no authentication or user interaction is indicated, but the specific feature, parameter, or endpoint that passes attacker data to unserialize() is not described in the available sources. A practical limiting factor for CWE-502 object injection is that meaningful impact (code execution, file or database operations) generally requires a reachable POP gadget chain in the theme, an installed plugin, or WordPress core; the evidence does not confirm such a chain exists, so real-world impact may be narrower than the 9.8 score implies. Exploitation is also limited to sites running the Save Life theme at version 1.2.14 or earlier.

The input presents a strong but partly unverified risk picture. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today priority is labelled act_now. However, several signals that would normally corroborate that urgency are absent: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no SSVC decision tree (automatable/technical-impact) is supplied - the act_now label is the only decision signal and it comes from an aggregator, not CISA. CWE-502 (deserialization of untrusted data / PHP object injection) is genuinely dangerous, but its real-world impact depends on the presence of a usable POP gadget chain in the theme or the loaded plugin/WordPress stack, and the description does not state how the untrusted data reaches unserialize() or whether a gadget chain is reachable - so the C:H/I:H/A:H rating is a worst-case assumption, not a demonstrated outcome. The only reference is a Patchstack database entry; it is a vulnerability record, not verified working exploit code. Net assessment: treat as a high-priority patch candidate given the network-unauthenticated CVSS and act_now label, but note that exploitability hinges on an undisclosed gadget chain and that no EPSS/KEV/exploit evidence confirms active or widespread exploitation - this looks like a Patchstack-researcher finding rather than a mass-exploited threat.

A remote attacker submits a crafted serialized PHP payload to an input that the Save Life theme passes to unserialize(), instantiating attacker-chosen objects (PHP object injection). If a suitable POP gadget chain exists in the theme, loaded plugins, or WordPress core, this could escalate to file operations, SQL interaction, or code execution. No verified working exploit code is identified; only a Patchstack vulnerability reference exists, and the exact trigger is not described in the available sources.