CVE-2026-112852

CVE-2026-112852 · WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

CVSS 8.1 · High · EPSS 0.3%

Published: 2026-10-23T13:00:18.393Z
Updated: 2026-10-24T14:47:00.462Z

Affected products and versions

helion
Versions
- ≥ 0, ≤ 1.1.12: Affected (custom)
No fix published

Original sources

https://patchstack.com/database/wordpress/theme/helion/vulnerability/wordpress-helion-theme-1-1-12-php-object-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-112852

Check your server →