CVE-2025-67619CWE-502

WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

High · published January 22, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

⚡ A crafty deserialization flaw in Kids Heaven could lead to a sneaky object injection attack! 🎠 Think of it like a toy factory that accepts any design without verifying its safety — one faulty prototype could lead to a whole line of dangerous toys being shipped out! If exploited, an attacker could inject malicious objects, potentially compromising the application and leading to unwanted access or manipulation of data. This could result in a serious breach of trust and integrity for any users involved!

Put simply

Think of it like a toy factory that accepts any design without verifying its safety — one faulty prototype could lead to a whole line of dangerous toys being shipped out! This vulnerability allows attackers to leverage untrusted data sent to the application, leading to object injection. Versions up to and including 3.2 are affected, which means outdated installations are particularly at risk.

What to do

If exploited, an attacker could inject malicious objects, potentially compromising the application and leading to unwanted access or manipulation of data. This could result in a serious breach of trust and integrity for any users involved! To protect your system, upgrade to the latest version of Kids Heaven immediately, and ensure you implement strict validation for all incoming data. Regular audits of your application may also help in mitigating future vulnerabilities. 🛡️ You've got this! By following these steps, you're moving towards a more secure environment! 🚀

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-01-22T16:51Z
EPSS history
Timeline
  • 22 JAN 16:51Z
    WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability
    cvelistv5