EUVD-2026-15625
GHSA-hchj-8847-5v46
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
AnalysisAI
A deserialization of untrusted data vulnerability exists in the park_of_ideas KIDZ theme that permits object injection attacks. All versions of KIDZ through 5.24 are affected, as confirmed via CPE cpe:2.3:a:park_of_ideas:kidz:*:*:*:*:*:*:*:*. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit park_of_ideas KIDZ versions <= 5.24 by sending untrusted serialized data over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Although CVSS and EPSS scores are not available in the provided intelligence, the underlying vulnerability type (deserialization of untrusted data) is consistently ranked among the most critical web application vulnerabilities by OWASP and CWE, typically resulting in remote code execution (CVSS base severity 8.6 or higher in comparable cases). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious serialized PHP object containing a gadget chain (a sequence of object methods and properties that culminate in code execution) and submits it via a vulnerable endpoint in the KIDZ theme—for example, through an AJAX handler, settings form, or custom REST endpoint that deserializes the data without validation. Upon deserialization, PHP instantiates the attacker's objects, triggering magic methods like __wakeup() or __destruct() that execute arbitrary shell commands, create backdoor admin users, or exfiltrate database credentials. … |
| Remediation | Immediately upgrade the KIDZ theme to a patched version beyond 5.24; check the Patchstack database and park_of_ideas official channels for the specific fixed version release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected systems and apply vendor patches immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today