CVE-2026-66569: CWE-502 Deserialization of Untrusted Data in axiomthemes Kicker

This vulnerability (CWE-502) involves unsafe deserialization in the Kicker theme by axiomthemes, affecting all versions up to and including 2.2.1. An attacker can exploit this flaw remotely without authentication to inject malicious PHP objects, potentially leading to complete confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code on the affected system, resulting in full system compromise including data theft, modification, or destruction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to vulnerable installations and monitor for suspicious activity related to PHP object injection attempts.