What is the CVSS score of CVE-2026-25031?

CVE-2026-25031 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tasty Daily are affected by CVE-2026-25031?

A critical PHP Object Injection vulnerability in the Tasty Daily WordPress theme (versions through 1.27) enables unauthenticated attackers to execute arbitrary code on affected WordPress sites…. A patch is available.

How to fix or mitigate CVE-2026-25031?

Within 24 hours: Identify all WordPress installations using Tasty Daily theme via admin dashboard or security scanner and document current versions. Within 7 days: Update the Tasty Daily theme to version 1.28 or later on all affected installations; disable the theme on any sites where immediate patching is not feasible. Within 30 days: Audit WordPress for unauthorized code modifications, review web server logs for exploitation attempts dating back 90 days, and validate all administrator accounts and API tokens.

Tasty Daily CVE-2026-25031

EUVD-2026-15629 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-mfxm-wvq7-wcg4

Deserialization Tasty Daily

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:48 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.27

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15629

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.

AnalysisAI

A PHP Object Injection vulnerability exists in the Tasty Daily WordPress theme (park_of_ideas) through version 1.27, caused by unsafe deserialization of untrusted data (CWE-502). This vulnerability allows attackers to inject arbitrary PHP objects, potentially leading to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published, the vulnerability affects an active WordPress theme distribution and has been documented by Patchstack security researchers.

Technical ContextAI

The vulnerability stems from a deserialization flaw in the Tasty Daily WordPress theme (CPE: cpe:2.3:a:park_of_ideas:tasty_daily). The root cause is classified under CWE-502 (Deserialization of Untrusted Data), a critical weakness where user-controlled input is passed to PHP deserialization functions (such as unserialize()) without proper validation. In WordPress themes, this typically occurs when handling serialized data from POST requests, cookies, or database fields without sanitization. WordPress environments frequently contain exploitable PHP object gadget chains in core libraries, plugins, and themes, making object injection particularly dangerous. An attacker can craft malicious serialized PHP objects that trigger chain gadgets during unserialization, potentially achieving arbitrary code execution with web server privileges.

RemediationAI

Immediately upgrade the Tasty Daily theme to version 1.27 or later, which resolves the object injection vulnerability. Users should access their WordPress admin dashboard, navigate to Appearance → Themes, locate Tasty Daily, and apply the available update. For WordPress sites that cannot immediately patch, implement input validation and sanitization policies at the web application firewall level to block suspicious serialized object payloads in POST/GET parameters and cookies. Additionally, restrict PHP object deserialization by disabling or configuring the dangerous serialize/unserialize functions in php.ini if feasible. Monitor WordPress error logs and web server access logs for signs of exploit attempts (unusual serialized strings or gadget chain patterns). Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/tastydaily/vulnerability/wordpress-tasty-daily-theme-1-27-php-object-injection-vulnerability for vendor-specific mitigation guidance.