CVE Intelligence
Analysis AI-assisted

CVE-2026-25029: WordPress KIDZ theme - PHP Object Injection vulnerability

A PHP Object Injection flaw, classified as deserialization of untrusted data (CWE-502), affects the KIDZ WordPress theme by park_of_ideas up to and including version 5.24. The CNA Patchstack rated it critical with a CVSS base score of 9.8, and no confirmed exploitation appears in the sources consulted. The record lists no fixed version, so the remediation status should be verified with the vendor and the Patchstack entry.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The KIDZ theme for WordPress, published by park_of_ideas, contains a deserialization of untrusted data weakness (CWE-502) that allows PHP Object Injection. The record was published on 2026-03-25 and the CNA Patchstack assigned it a critical severity with a CVSS base score of 9.8.

Impact

  • The record states that the flaw allows Object Injection, but it does not describe the concrete effects an attacker could achieve.
  • The reported vector indicates network reachability, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability (inference from the scoring data).
  • Because the affected component is a theme, the practical exposure depends on whether the vulnerable code path is reachable on the site.

Affected products and versions

  • Product: Park Of Ideas KIDZ, a WordPress theme.
  • Affected range: up to and including 5.24.
  • The lower bound of the range is not specified in the record (listed as n/a).
  • No fixed version is listed in the record.

Exploitation status

  • The record shows the KIDZ issue is not listed in the CISA KEV catalog.
  • No confirmed active exploitation appears in the sources consulted.
  • The SSVC data in the record reports exploitation as none and automatable as yes.
  • The EPSS probability is 0.00389 with a percentile of 0.31818, dated 2026-10-23 in the record; that date should be verified because it is later than the publication date.

Remediation and mitigation

  • Identify whether any site uses KIDZ at version 5.24 or earlier.
  • Check the Patchstack entry and the vendor for an updated release, since the record does not provide one.
  • If no fixed release is available, consider temporarily deactivating the theme or restricting access to affected sites, and plan a replacement.
  • Keep WordPress core, other themes and plugins updated, and maintain tested backups.

Detection guidance

  • Review web server and application logs for unusual requests to theme-related functionality.
  • Monitor for unexpected PHP errors that reference object handling or unserialization.
  • Use file integrity monitoring on the theme directory to detect unauthorized changes.

Limitations of the available information

  • No fixed version is provided in the record.
  • The lower bound of the affected range is not specified.
  • No technical details of the vulnerable code path or exploitation conditions are included.
  • Only one vulnerability database entry is referenced, and the EPSS date should be checked.

Frequently asked questions

Which versions of the KIDZ theme are affected?

The record lists the KIDZ theme by park_of_ideas as affected up to and including 5.24. The lower bound is not specified.

Is there a fixed version available?

The record does not list a fixed version. Check the vendor and the Patchstack entry for an updated release.

Is this vulnerability being actively exploited?

The record shows the issue is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.