CVE-2026-25358
Published: 25 March 2026
Summary
CVE-2026-25358 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediates the deserialization flaw in Meloo theme versions prior to 2.8.2 by applying timely patches or updates as recommended.
Validates untrusted inputs to the WordPress theme to prevent deserialization of malicious data leading to object injection.
Scans WordPress themes for vulnerabilities like CVE-2026-25358 to identify and prioritize remediation of deserialization flaws.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote deserialization/RCE in public-facing WordPress theme (authenticated low-priv user, no interaction), directly enabling T1190 exploitation of Internet-facing apps and subsequent arbitrary command execution via Unix shell on the server.
NVD Description
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
Deeper analysisAI
CVE-2026-25358 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Meloo WordPress theme developed by rascals, enabling object injection. The issue affects all versions of Meloo from n/a through those prior to 2.8.2. Published on 2026-03-25, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
Attackers with low privileges, such as authenticated users, can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows object injection via deserialization of untrusted data, potentially leading to arbitrary code execution, data manipulation, or system compromise on the targeted WordPress site.
Patchstack advisories recommend updating the Meloo theme to version 2.8.2 or later, where the object injection vulnerability has been addressed. No additional mitigations are specified in the provided references.
Details
- CWE(s)