What is the CVSS score of EUVD-2026-15627?

EUVD-2026-15627 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Goldish are affected by EUVD-2026-15627?

The park_of_ideas Goldish theme (versions before 3.47) contains a critical PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code on affected web servers.. A patch is available.

How to fix or mitigate EUVD-2026-15627?

Within 24 hours: Identify all instances of Goldish theme deployed across your WordPress infrastructure and document current versions. Within 7 days: Update all affected Goldish installations to version 3.47 or later. Within 30 days: Conduct code review and security testing on any custom WordPress plugins or themes that may deserialize untrusted user input, and implement request validation rules to block suspicious serialized data patterns.

Goldish EUVD-2026-15627

| CVE-2026-25030 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

Deserialization Goldish

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:48 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.47

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15627

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.

AnalysisAI

A PHP Object Injection vulnerability exists in the park_of_ideas Goldish theme due to insecure deserialization of untrusted data, allowing attackers to inject arbitrary objects and potentially achieve remote code execution or other malicious outcomes. The vulnerability affects Goldish versions prior to 3.47. While no CVSS score or EPSS data is publicly available, the CWE-502 classification indicates a serious deserialization flaw that could be exploited if untrusted data is processed without validation.

Technical ContextAI

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a critical weakness in PHP applications where user-supplied data is unserialized without proper validation or sanitization. The Goldish theme (CPE: cpe:2.3:a:park_of_ideas:goldish:*:*:*:*:*:*:*:*) is a WordPress theme that likely uses PHP's unserialize() function or similar mechanisms to reconstruct objects from serialized data. When an attacker controls the serialized input, they can craft malicious object payloads that exploit PHP's magic methods (__wakeup, __destruct, __toString, etc.) to trigger unintended code execution or chain gadget sequences leading to remote code execution. The vulnerability represents a fundamental failure to treat deserialized data as untrusted, even when it originates from user input, HTTP requests, or other external sources.

RemediationAI

Immediately upgrade the Goldish theme to version 3.47 or later, which contains the fix for this object injection vulnerability. Access the WordPress theme update mechanism or download the patched version directly from the official Goldish repository. Until patching is feasible, disable or restrict access to any functionality in Goldish that accepts serialized data from user input, and conduct a security audit to identify any other potential deserialization points in your WordPress installation. Consider implementing a Web Application Firewall (WAF) rule to detect and block suspicious serialized object patterns in HTTP requests. For detailed remediation guidance, refer to the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/goldish/vulnerability/wordpress-goldish-theme-3-47-php-object-injection-vulnerability.