CVE Intelligence
Analysis AI-assisted

CVE-2026-25030: WordPress Goldish Theme - PHP Object Injection

CVE-2026-25030 is a deserialization of untrusted data flaw (CWE-502) in the Goldish WordPress theme by Park Of Ideas that allows PHP object injection. The Patchstack CNA scored it 9.8 (critical) and describes it as affecting versions before 3.47. The record shows no confirmed exploitation, no KEV listing, and no fixed-version field, so administrators should verify the patched release with the vendor or Patchstack.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The Patchstack CNA published CVE-2026-25030 for the Goldish theme for WordPress. It is classified as deserialization of untrusted data (CWE-502) and allows PHP object injection. The record gives the affected range in two forms, as up to 3.47 in the product entry and as before 3.47 in the description, so the exact boundary should be confirmed.

Impact

  • The Patchstack CVSS base score is 9.8, rated critical.
  • The SSVC data in the record marks the issue as automatable, with total technical impact.
  • The concrete consequences depend on how the theme handles serialized input, which the consulted sources do not describe.

Affected products and versions

  • Product: Park Of Ideas Goldish (Goldish theme for WordPress).
  • Affected range: before 3.47 according to the description; the structured entry reads up to and including 3.47.
  • No fixed version is listed in the record. The title suggests 3.47 as the first corrected release, but this is an inference that must be confirmed.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record shows an EPSS probability of 0.00389 (percentile 0.31818), dated 2026-10-23, and an SSVC exploitation value of none.

Remediation and mitigation

  • Check the installed Goldish version and, if it is before 3.47, plan an update to the release confirmed by the vendor as fixed.
  • If an update cannot be applied quickly, consider deactivating the theme while keeping a tested rollback plan.
  • Restrict access to administrative areas and keep WordPress core and other plugins and themes up to date.

Detection guidance

  • Review web server and application logs for unusual requests to the theme or unexpected parameters carrying serialized data.
  • Look for unexpected changes to files, users or site settings, and for unusual administrative activity.
  • Compare the installed theme files against a trusted copy after updating.

Limitations of the available information

  • The record contains no fixed version field and no vendor advisory, only the Patchstack database entry.
  • The affected boundary is written inconsistently as before 3.47 and as up to 3.47.
  • No technical details beyond the weakness class are available in the sources consulted, and this analysis does not describe exploitation steps.

Frequently asked questions

Is CVE-2026-25030 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

Which Goldish versions are affected?

The description says versions before 3.47, while the structured entry says up to 3.47, so the exact boundary should be confirmed with the vendor or Patchstack.

What should administrators do now?

Check the installed Goldish version, plan an update to a release confirmed as fixed, and consider deactivating the theme if an update cannot be applied quickly.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.