CVE-2025-60084: 
WordPress vulnerability analysis and mitigation

CVE-2025-60084 is a Deserialization of Untrusted Data (PHP Object Injection) vulnerability in the "PDF for Elementor Forms + Drag And Drop Template Builder" WordPress plugin developed by add-ons.org. It affects all versions from n/a through 6.5.0 (with the ENISA advisory referencing versions through 6.3.1). The vulnerability was published on December 18, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 8.6 (High), exploitable remotely without authentication or user interaction (Feedly, EUVD).

The root cause is improper deserialization of untrusted user-supplied data within the plugin, classified as CWE-502 (Deserialization of Untrusted Data) and mapped to CAPEC-586 (Object Injection). An unauthenticated remote attacker can craft a malicious serialized PHP object and submit it to a vulnerable endpoint exposed by the plugin; when the plugin deserializes this input without validation, the attacker-controlled object is instantiated, potentially triggering PHP magic methods (__wakeup, __destruct, etc.) that execute arbitrary logic. No authentication, privileges, or user interaction are required, and attack complexity is low (Feedly).

Successful exploitation can lead to complete compromise of the affected WordPress site, including remote code execution, unauthorized access to sensitive data, and manipulation of application logic through injected objects. The high confidentiality impact means sensitive site data (user credentials, form submissions, configuration) may be exfiltrated, while integrity and availability impacts are rated low, indicating potential for limited data modification and service disruption. Lateral movement within a shared hosting environment or further pivoting to underlying server infrastructure is also a realistic risk (Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.057%, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the "PDF for Elementor Forms + Drag And Drop Template Builder" plugin (versions ≤ 6.5.0) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/pdf-for-elementor-forms/).
2. Identify vulnerable endpoint: Locate the plugin's form submission or PDF generation endpoint that processes serialized PHP data without proper validation.
3. Craft malicious payload: Construct a serialized PHP object (gadget chain) targeting classes available in the WordPress/plugin environment that implement exploitable magic methods (__wakeup, __destruct, __toString), using tools like PHPGGC to generate the gadget chain.
4. Submit payload: Send the crafted serialized object to the vulnerable endpoint via an HTTP POST request, without requiring authentication.
5. Trigger deserialization: The plugin deserializes the attacker-supplied object, invoking magic methods that execute arbitrary PHP code or system commands on the server.
6. Achieve objective: Depending on available gadget chains, the attacker may achieve remote code execution, write a web shell, exfiltrate data, or escalate privileges on the WordPress installation (Feedly).

• Network: Unexpected or malformed POST requests to plugin-related endpoints (e.g., paths under /wp-content/plugins/pdf-for-elementor-forms/) containing serialized PHP data patterns (e.g., O:<number>: strings in request bodies).
• Logs: WordPress or web server access logs showing unusual POST requests with large or encoded payloads to plugin endpoints; PHP error logs referencing unexpected class instantiation or magic method execution.
• File System: Newly created or modified PHP files in the WordPress installation directory, particularly web shells (e.g., files with names like shell.php, cmd.php) or unexpected changes to plugin files.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python executing system commands.

The primary remediation is to update the "PDF for Elementor Forms + Drag And Drop Template Builder" plugin to a version beyond 6.5.0 (the latest patched release). If an immediate update is not possible, temporarily deactivating the plugin is recommended to eliminate the attack surface. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing serialized PHP object patterns (O:<digits>:) targeting plugin endpoints. Monitor for suspicious activity and restrict access to WordPress admin and plugin endpoints where feasible (Feedly).

The vulnerability was reported and assigned by Patchstack, a WordPress security platform, and published to their vulnerability database. A brief mention appeared on Bluesky via an automated CVE feed shortly after disclosure. No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond the initial Patchstack disclosure (Feedly).