Skip to main content

Tasty Daily CVE-2026-25031

| EUVD-2026-15629 CRITICAL
Deserialization of Untrusted Data (CWE-502)
2026-03-25 Patchstack GHSA-mfxm-wvq7-wcg4
Deserialization Tasty Daily
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Re-analysis Queued
Apr 24, 2026 - 16:37 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 05:48 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
1.27
EUVD ID Assigned
Mar 25, 2026 - 16:47 euvd
EUVD-2026-15629
Analysis Generated
Mar 25, 2026 - 16:47 vuln.today
CVE Published
Mar 25, 2026 - 16:14 nvd
CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.

AnalysisAI

A PHP Object Injection vulnerability exists in the Tasty Daily WordPress theme (park_of_ideas) through version 1.27, caused by unsafe deserialization of untrusted data (CWE-502). This vulnerability allows attackers to inject arbitrary PHP objects, potentially leading to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send malicious serialized object
Exploit
Trigger unsafe deserialization in Tasty Daily
Execution
Inject arbitrary object graph
Impact
Execute arbitrary code with application privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Remote unauthenticated attacker can exploit Tasty Daily versions before 1.27 by sending crafted serialized objects to the application. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment While a CVSS vector and EPSS score are not yet assigned, the inherent risk is substantial due to the nature of PHP object injection vulnerabilities in WordPress contexts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious serialized PHP object containing references to gadget chains available in the WordPress environment (e.g., via popular plugins or WordPress core). The attacker submits this serialized payload via a POST request, cookie, or query parameter to a public endpoint in the Tasty Daily theme that performs unsafe deserialization without input validation. …
Remediation Immediately upgrade the Tasty Daily theme to version 1.27 or later, which resolves the object injection vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all WordPress installations using Tasty Daily theme via admin dashboard or security scanner and document current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-25031 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy