A vulnerability in the park_of_ideas KIDZ WordPress theme allows PHP Object Injection due to deserialization of untrusted data. This flaw, classified as CWE‑502, enables an attacker to instantiate arbitrary PHP objects when the theme processes incoming data. When successfully exploited, the attacker can execute arbitrary PHP code on the affected WordPress installation, compromising confidentiality, integrity, and availability of the site.

All releases of the KIDZ theme from the initial version through version 5.24 are affected, regardless of the underlying WordPress core version. The theme, distributed by park_of_ideas and referred to as KIDZ, presents the vulnerability whenever it is present in a WordPress site.

The CVSS score of 9.8 indicates a critical severity, yet the EPSS score of less than 1 % shows that exploitation is currently rare. The likely attack vector is network‑based delivery of a crafted serialized payload to the theme’s processing endpoint. Based on the description, it is inferred that an attacker could transmit malicious data via HTTP requests that trigger PHP’s unserialize function. Successful exploitation would grant remote code execution. Although the vulnerability is not yet listed in CISA’s KEV catalog, its high severity and potential for complete site compromise demand immediate action.