CVE-2025-60080: 
WordPress vulnerability analysis and mitigation

CVE-2025-60080 is a Deserialization of Untrusted Data (PHP Object Injection) vulnerability in the "PDF for Gravity Forms + Drag And Drop Template Builder" WordPress plugin developed by add-ons.org. The vulnerability affects all versions of the plugin up to and including 6.5.0 (per NVD) or 6.3.0 (per ENISA/Patchstack). It was published on December 18, 2025, and assigned by Patchstack. The CVSS v3.1 base score is 7.5 (High) (Feedly).

The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and maps to CAPEC-586 (Object Injection). An authenticated attacker with low privileges can send a crafted network request containing a malicious serialized PHP object, which the plugin deserializes without adequate validation or sanitization. Successful exploitation requires high attack complexity and no user interaction, suggesting that specific conditions or gadget chains within the WordPress environment must be met to achieve meaningful impact (Feedly).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected WordPress installation. Depending on available PHP gadget chains in the environment, an attacker could achieve arbitrary code execution, read or modify sensitive data, delete files, or cause a denial of service. The scope is unchanged, meaning the impact is contained to the vulnerable component and its host environment, but lateral movement within the server is possible if code execution is achieved (Feedly).

The EPSS score for CVE-2025-60080 is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the wild. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authentication and high attack complexity, which somewhat limits opportunistic exploitation (Feedly).

1. Reconnaissance: Identify WordPress sites running the "PDF for Gravity Forms + Drag And Drop Template Builder" plugin at version 6.5.0 or earlier using tools like WPScan or Shodan.
2. Authentication: Obtain a low-privileged WordPress account (e.g., subscriber or contributor role) on the target site.
3. Identify vulnerable endpoint: Locate the plugin functionality that accepts and processes serialized PHP data (e.g., a form submission or settings endpoint handled by the plugin).
4. Craft malicious payload: Construct a serialized PHP object payload leveraging available gadget chains in the WordPress/plugin environment (e.g., using tools like PHPGGC to generate a suitable gadget chain for code execution, file write, or other impact).
5. Submit payload: Send the crafted serialized object to the vulnerable endpoint via an authenticated HTTP request.
6. Trigger deserialization: The plugin deserializes the untrusted input, invoking magic methods (__wakeup, __destruct, etc.) in the gadget chain, achieving the attacker's objective (e.g., remote code execution, file deletion, or data exfiltration) (Feedly).

• Network: Unusual authenticated POST requests to plugin-specific endpoints with serialized PHP data (e.g., O:<length>:"<classname>" patterns in request bodies or parameters).
• Logs: WordPress or web server access logs showing repeated requests to PDF for Gravity Forms plugin endpoints from a single low-privileged user account; PHP error logs referencing unexpected class instantiation or magic method invocation.
• File System: Unexpected new PHP files or web shells in the WordPress uploads directory or plugin directory; modified plugin files with injected code.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following plugin endpoint requests.

Users should update the "PDF for Gravity Forms + Drag And Drop Template Builder" plugin to a version beyond 6.5.0 (the latest patched release) as soon as one becomes available from add-ons.org or the WordPress plugin repository. In the interim, site administrators should consider deactivating or removing the plugin if it is not critical to operations. Restricting access to WordPress contributor/subscriber registration and applying a web application firewall (WAF) rule to block serialized PHP object patterns in HTTP requests can serve as additional mitigations (Feedly, Patchstack).