CVE-2026-25030: 
WordPress vulnerability analysis and mitigation

CVE-2026-25030 is a PHP Object Injection vulnerability (Deserialization of Untrusted Data) affecting the Goldish WordPress theme developed by park_of_ideas. It affects all versions of the Goldish theme prior to 3.47, and was reported by researcher João Pedro S Alcântara (Kinorth) on January 8, 2026, with public disclosure on March 23–25, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), requiring no authentication, no user interaction, and exploitable remotely with low complexity (Patchstack, EUVD).

The root cause is improper deserialization of untrusted data (CWE-502), classified under OWASP Top 10 A3: Injection and mapped to CAPEC-586 (Object Injection). An unauthenticated remote attacker can send a crafted network request containing a malicious serialized PHP object, which the theme deserializes without adequate validation. If a suitable PHP Object Injection (POP) chain exists within the WordPress installation or its plugins, this can be leveraged to achieve code execution, SQL injection, path traversal, or denial of service (Patchstack).

Successful exploitation can result in complete compromise of the affected WordPress site, with high impact to confidentiality, integrity, and availability. Depending on available POP chains in the environment, an attacker could execute arbitrary code, perform SQL injection, traverse the file system, or cause a denial of service — all without requiring any credentials or user interaction. The broad attack surface of WordPress installations (with numerous plugins and themes potentially providing POP chain gadgets) amplifies the risk of full site takeover and potential lateral movement within shared hosting environments (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity.

1. Reconnaissance: Identify WordPress sites using the Goldish theme (versions < 3.47) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify deserialization entry point: Analyze the Goldish theme source code to locate where user-supplied input is passed to PHP's unserialize() function without sanitization.
3. Identify POP chain: Survey installed WordPress plugins and themes on the target for classes with magic methods (__wakeup, __destruct, __toString) that can be chained to achieve a desired effect (e.g., file write, command execution).
4. Craft malicious payload: Construct a serialized PHP object payload that instantiates the identified POP chain gadgets, targeting the desired impact (e.g., remote code execution or file write).
5. Deliver payload: Send an unauthenticated HTTP request to the vulnerable endpoint in the Goldish theme, embedding the crafted serialized object in the appropriate parameter.
6. Achieve objective: If a valid POP chain is present, the deserialized object triggers the chain, resulting in code execution, data exfiltration, or other attacker-controlled outcomes (Patchstack).

• Network: Unusual or malformed HTTP requests to WordPress theme endpoints containing serialized PHP object strings (e.g., patterns like O:<number>:"<classname>" in request parameters or cookies).
• Logs: WordPress or web server access logs showing repeated unauthenticated requests to theme-specific endpoints with large or encoded payloads; PHP error logs referencing unexpected class instantiation or __wakeup/__destruct method calls.
• File System: Unexpected new PHP files (web shells) in the WordPress theme directory or wp-content/uploads; modifications to existing theme or core files with injected code.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) indicating command execution via a POP chain.

The vendor has released version 3.47 of the Goldish theme, which patches this vulnerability. All users of the Goldish theme should immediately update to version 3.47 or later. Patchstack has also issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts until the theme is updated. If immediate updating is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

Wordfence included CVE-2026-25030 in its weekly WordPress vulnerability report covering March 23–29, 2026, highlighting it among notable disclosures for that period (Wordfence). Patchstack, the assigning CNA, emphasized the high danger of PHP Object Injection vulnerabilities in WordPress themes and their frequent use in mass-exploit campaigns, urging immediate patching (Patchstack).