What is the CVSS score of CVE-2026-25029?

CVE-2026-25029 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Kidz are affected by CVE-2026-25029?

Organizations using Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz face critical risk from CVE-2026-25029, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-25029?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Kidz CVE-2026-25029

EUVD-2026-15625 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-hchj-8847-5v46

Deserialization Kidz

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15625

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.

AnalysisAI

A deserialization of untrusted data vulnerability exists in the park_of_ideas KIDZ theme that permits object injection attacks. All versions of KIDZ through 5.24 are affected, as confirmed via CPE cpe:2.3:a:park_of_ideas:kidz:*:*:*:*:*:*:*:*. An attacker can inject malicious serialized PHP objects to achieve arbitrary code execution or other unintended actions on affected WordPress installations running this theme.

Technical ContextAI

This vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical weakness in which PHP's unserialize() function or equivalent deserialization mechanisms process attacker-controlled input without validation. The KIDZ theme, a WordPress theme published by park_of_ideas, likely processes user-supplied or externally sourced serialized data (possibly from $_POST, $_GET, cookies, or configuration files) and directly deserializes it using unsafe PHP functions. This allows an attacker to instantiate arbitrary PHP objects and trigger object injection chains, potentially leveraging autoloaders, magic methods (__wakeup, __destruct), or property overloading to execute code. WordPress themes are particularly susceptible because they often handle custom post metadata, settings, and user input without sufficient sanitization before deserialization.

RemediationAI

Immediately upgrade the KIDZ theme to a patched version beyond 5.24; check the Patchstack database and park_of_ideas official channels for the specific fixed version release. Until an official patch is available, disable the KIDZ theme and switch to an alternative theme that has not been reported for deserialization vulnerabilities. Additionally, implement the following defensive measures: restrict WordPress administrative access to trusted IP addresses, enforce strict input validation and sanitization on all user-supplied data before any deserialization operation, use Web Application Firewall (WAF) rules to block serialized PHP object patterns in request payloads, and maintain regular security audits of custom theme and plugin code. Monitor the Patchstack advisory and WordPress.org security notices for patch availability: https://patchstack.com/database/Wordpress/Theme/kidz/vulnerability/wordpress-kidz-theme-5-24-php-object-injection-vulnerability