What is the CVSS score of EUVD-2026-108949?

EUVD-2026-108949 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-108949?

Within 24 hours, identify all WordPress sites using the ThemeREX Helion theme and determine if they are running version 1.1.12 or earlier; if so, immediately deactivate and remove the theme unless absolutely necessary, and if it must remain active, restrict access to the site's deserialization endpoints via a web application firewall (WAF) rule blocking suspicious PHP object injection patterns. Within 7 days, if the theme cannot be removed, deploy a virtual patch through the WAF and conduct a thorough security audit of installed plugins and WordPress core to identify and remove any known gadget chains, while closely monitoring for signs of compromise. Within 30 days, replace the vulnerable theme with a supported alternative, or if a vendor patch becomes available, apply it promptly and verify that all sites have been updated; additionally, review and harden overall WordPress security configurations to reduce the risk of similar vulnerabilities.

ThemeREX Helion EUVD-2026-108949

| CVE-2026-112852 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-10-23 Patchstack

GHSA-6p2h-2hxg-g4q7

WordPress Deserialization Wordpress Theme Themerex Group Helion

8.1

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach theme deserialization endpoint over HTTP
Exploit

Submit crafted serialized PHP object
Execution

Trigger object injection via gadget chain
Impact

Achieve code execution or data compromise

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires reaching a Helion theme code path that deserializes attacker-supplied data; per the CVSS vector it is unauthenticated (PR:N) and needs no user interaction (UI:N), affecting Helion versions up to and including 1.1.12. The concrete feature, endpoint, or parameter that performs the unsafe deserialization is not described in the available sources. The key limiting factor is AC:H combined with the object-injection class: achieving the stated high impact depends on a usable PHP gadget chain existing in the theme, an installed plugin, or WordPress core, which the evidence does not confirm; it also requires the vulnerable Helion theme to be installed and active.
Impact	This is a CWE-502 PHP Object Injection flaw in the ThemeREX Helion WordPress theme (versions up to and including 1.1.12), carrying a vendor/NVD CVSS 3.1 base score of 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - i.e. network-reachable, no privileges and no user interaction required, but with high attack complexity and full confidentiality/integrity/availability impact within the WordPress instance. The signals are mixed: the CVSS is high and the access profile (unauthenticated, remote) is favorable to an attacker, but AC:H and the nature of object injection mean impact is contingent on a usable gadget chain being present in the theme, plugins, or WordPress core, which the available evidence does not confirm. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact breakdown were supplied; the only prioritization signal is the vuln.today 'this_week' decision label and the Patchstack report. There is no confirmed exploitation and no verified working exploit code - only a Patchstack advisory reference - so this currently reads as a credible, patch-this-week issue rather than an emergency. The high complexity and the comparatively narrow deployment footprint of a single commercial WordPress theme temper the real-world urgency relative to the raw 8.1 score.
Exploit ScenarioDerived	A remote, unauthenticated attacker submits crafted serialized data to a Helion theme code path that deserializes untrusted input, instantiating attacker-chosen PHP objects. If a suitable gadget chain exists in the theme, installed plugins, or WordPress core, this object injection can be escalated toward code execution, data disclosure, or site compromise. No verified working exploit code is available - only a Patchstack advisory reference - and the exact triggering endpoint is not described in the available sources.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 23, 2026

Unauthenticated PHP object injection in the ThemeREX Helion WordPress theme, affecting versions up to and including 1.1.12, carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated for remediation this week. Because the vector is PR:N and UI:N, any remote attacker who can reach the theme's vulnerable deserialization path needs neither credentials nor victim interaction, though the AC:H rating reflects that the high confidentiality, integrity and availability impact depends on a usable PHP gadget chain being present in the theme, an installed plugin, or WordPress core - a condition the available sources do not confirm. The specific feature, endpoint or parameter that performs the unsafe deserialization is not described in the available sources, and no public exploit code or active exploitation is identified in the available intelligence. Sites are exposed only where the vulnerable Helion theme is installed and active at version 1.1.12 or earlier.

RemediationAI

No vendor-released patch is identified in the available data: the supplied advisory covers Helion through 1.1.12 and lists no fixed version, so confirm the current release status on the Patchstack advisory at https://patchstack.com/database/wordpress/theme/helion/vulnerability/wordpress-helion-theme-1-1-12-php-object-injection-vulnerability?_s_id=cve before upgrading, and apply the first release published above 1.1.12 when it appears - the decision label places this work in the current week rather than an emergency response. Until a patched theme version is available and validated, the most direct compensating control is to deactivate the Helion theme and switch the site to a maintained alternative, since the assessment confirms exploitation requires the vulnerable theme to be installed and active; the trade-off is an immediate change to site appearance and any theme-specific templates, widgets or customizations that depend on Helion, so stage the swap on a copy of the site first. Because the feature, endpoint or parameter performing the unsafe deserialization is not described in the available sources, no narrower request-filtering or access rule can be recommended with confidence, and deactivation should be treated as the complete interim mitigation rather than a partial one.

Affected VersionsENISA

Helion 0 ≤1.1.12

Affected Packages

euvd helion no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This is a CWE-502 Deserialization of Untrusted Data (PHP Object Injection) flaw in the ThemeREX Helion WordPress theme, tracked against the CPE cpe:2.3:a:themerex_group:helion, which confirms the affected component is the theme itself rather than WordPress core. The class of bug arises when PHP's unserialize() (or an equivalent unserialization routine) is applied to data an attacker can supply, letting the attacker control the properties of instantiated objects; the resulting damage is determined by which magic methods (such as __wakeup, __destruct or __toString) exist along a reachable gadget chain in the loaded codebase. That dependency is precisely why the assessed vector is AC:H despite PR:N and UI:N: reaching the deserialization sink is unauthenticated and requires no user interaction, but converting object injection into the stated high confidentiality, integrity and availability impact requires a suitable gadget chain in the theme, an installed plugin, or WordPress core, which the available evidence does not confirm. The concrete feature, endpoint, AJAX action or parameter that performs the unsafe deserialization is not described in the available sources, so the trigger cannot be characterized beyond the object-injection class itself.

Know when Helion gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.1 HIGH

Remote and unauthenticated (AV:N/PR:N/UI:N); AC:H because object-injection impact depends on a gadget chain the sources do not confirm; full C/I/A impact on the unchanged WordPress site scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

Executive ViewAI

Why It Matters

CVE-2026-112852 is a high-severity vulnerability in the ThemeREX Helion WordPress theme (versions up to 1.1.12) that allows unauthenticated attackers to potentially compromise site confidentiality, integrity, and availability, though exploitation depends on a usable PHP gadget chain being present. As no patch is available and the vulnerability affects a widely used theme, leadership should prioritize identification and mitigation of affected sites to prevent potential data breaches or site takeover.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include removing or deactivating the vulnerable theme, restricting access to vulnerable endpoints via WAF, and eliminating gadget chains by updating or removing plugins and core components that may contain exploitable code.

Threat Intelligence Overview

EPSS Score

0.4%

Top 63% exploitable

Prevalence

Low

single commercial WordPress theme, niche vendor, limited deployment footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.