{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32510", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:12:13.806Z", "datePublished": "2026-03-25T16:15:04.782Z", "dateUpdated": "2026-03-25T16:15:04.782Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://themeforest.net", "defaultStatus": "unaffected", "packageName": "kamperen", "product": "Kamperen", "vendor": "Edge-Themes", "versions": [{"changes": [{"at": "1.3", "status": "unaffected"}], "lessThanOrEqual": "< 1.3", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Denver Jackson | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:40.565Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.<p>This issue affects Kamperen: from n/a through < 1.3.</p>"}], "value": "Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "Object Injection"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:15:04.782Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Theme/kamperen/vulnerability/wordpress-kamperen-theme-1-3-arbitrary-object-instantiation-vulnerability?_s_id=cve"}], "title": "WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3."}], "id": "CVE-2026-32510", "lastModified": "2026-03-25T17:17:03.280", "metrics": {}, "published": "2026-03-25T17:17:03.280", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Theme/kamperen/vulnerability/wordpress-kamperen-theme-1-3-arbitrary-object-instantiation-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-25T18:29:57.165261+00:00", "value": {"mitigation_remediation": ["Verify the current Kamperen theme version in the WordPress dashboard or theme folder.", "Upgrade the theme to version 1.3 or newer as soon as possible.", "If an upgrade cannot be performed immediately, remove or deactivate the Kamperen theme from the site."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Object Instantiation leading to potential code execution"}, "threat_synthesis": {"affected_systems": "The issue is present in WordPress websites that use the Edge\u2011Themes Kamperen theme version below 1.3. Any installation of that theme is potentially vulnerable unless the theme has been updated to 1.3 or newer.", "description_and_impact": "This vulnerability allows an attacker to deserialize untrusted data and instantiate arbitrary objects. By crafting a payload that triggers the theme\u2019s deserialization routine, an attacker can potentially gain code execution on the hosting server. The weakness is a classic object deserialization flaw (CWE\u2011502), giving the attacker control over the application's execution flow and compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "Because the flaw is an arbitrary object instantiation, it is considered high severity. The CVSS score is not provided, but the ability to achieve code execution makes exploitation highly valuable. The EPSS score is unavailable, and the vulnerability is not listed in KEV, yet the lack of public patches suggests that attackers may target sites that have not updated. The likely attack vector would be a remote attacker supplying a crafted payload, possibly via a form, URL parameter, or administrative interface that triggers the theme\u2019s deserialization code. Detailed attack prerequisites are unclear from the description, so we infer that the attacker needs write access to data that the theme processes."}}}}, "created": "2026-03-25T21:47:30.024054+00:00", "updated": "2026-03-25T21:47:30.024078+00:00", "vendors": []}