WordPress - Kubio AI Website Builder DoS

The REST endpoint `GET /wp-json/kubio/v1/enable-theme` passes the client-supplied `name` parameter directly and without validation into WordPress core's `switch_theme()`:

// lib/api/colibri.php
function kubio_enable_theme( WP_REST_Request $data ) {
   switch_theme( $data['name'] );                       // <-- no type/value validation
   return wp_send_json( array( 'switched' => $data['name'] ) );
}

Because `$data['name']` is not type-checked, an authorized request can supply `name` as an array instead of a string. `switch_theme()` persists that value into the `stylesheet` / `template` options, where it is stored as a serialized array. On the next page load WordPress core calls `get_stylesheet()` which is typed to return a string and fatals with a `TypeError` during theme bootstrap, taking the entire site down.

The failure is persistent, the corrupted option is reloaded on every request.