CVE-2025-69371: WordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerability

Q: What access would an attacker need to exploit this issue?

The CVSS vector indicates the issue is network-accessible, requires low attack complexity, and does not require privileges or user interaction.

Q: Which deployments should be treated as affected during inventory and triage?

Deployments using the AncoraThemes KindlyCare theme at version 1.6.1 or earlier should be treated as in scope based on the reported affected range.

Q: What could successful exploitation allow?

The reported CVSS score is 9.8 critical, with high impacts to confidentiality, integrity, and availability. The CVSS vector indicates the scope is unchanged.

Published Feb 20, 2026

Updated

Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.

Affected Software

1 affected component

AncoraThemes KindlyCare<=1.6.1

Event History

Feb 20, 2026

CVE Published

via MITRE·03:46 PM

Data Sourced

via MITRE·03:46 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The CVSS vector indicates the issue is network-accessible, requires low attack complexity, and does not require privileges or user interaction.

Which deployments should be treated as affected during inventory and triage?

Deployments using the AncoraThemes KindlyCare theme at version 1.6.1 or earlier should be treated as in scope based on the reported affected range.

What could successful exploitation allow?