CVE-2025-60089: 
WordPress vulnerability analysis and mitigation

CVE-2025-60089 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the CRM Perks WP Gravity Forms FreshDesk Plugin for WordPress, allowing unauthenticated remote attackers to perform PHP Object Injection. It affects all versions of the plugin up to and including 1.3.5, with version 1.3.6 introducing the fix. The vulnerability was published on December 18, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly, Patchstack).

The root cause is improper deserialization of untrusted user-supplied data within the WP Gravity Forms FreshDesk Plugin (CWE-502), which enables PHP Object Injection (CAPEC-586). An unauthenticated remote attacker can send a crafted network request containing a malicious serialized PHP object, which the plugin deserializes without adequate validation or integrity checks. Depending on the PHP classes available in the application's scope (gadget chains), this can be escalated to arbitrary code execution, file manipulation, or other high-impact actions. No user interaction or authentication is required, making this exploitable entirely remotely (Feedly).

Successful exploitation can result in complete compromise of the affected WordPress site, with high impact to confidentiality, integrity, and availability. An attacker could execute arbitrary code on the server, access or exfiltrate sensitive data (including credentials and customer information), modify or delete site content, and potentially pivot to other systems on the same hosting environment. The unauthenticated, network-accessible nature of the vulnerability significantly broadens the attack surface for any WordPress installation running the affected plugin versions (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. However, the critical CVSS score and lack of authentication requirement make it a high-priority patching target should a PoC emerge (Feedly).

1. Reconnaissance: Identify WordPress sites running the WP Gravity Forms FreshDesk Plugin (gf-freshdesk) version ≤ 1.3.5 using tools like WPScan, Shodan, or by checking plugin metadata at https://target.com/wp-content/plugins/gf-freshdesk/readme.txt.
2. Identify deserialization endpoint: Locate the plugin's input-handling endpoint or form submission handler that processes serialized PHP data without authentication.
3. Craft malicious payload: Construct a serialized PHP object payload leveraging available gadget chains in the WordPress/PHP environment (e.g., using tools like PHPGGC) to achieve the desired effect (e.g., remote code execution, file write).
4. Deliver payload: Submit the crafted serialized object via an HTTP request to the vulnerable endpoint, without requiring any authentication or user interaction.
5. Achieve objective: If a suitable gadget chain exists, the deserialized object triggers arbitrary code execution, enabling webshell upload, data exfiltration, or further lateral movement within the hosting environment (Feedly).

• Network: Unusual HTTP POST requests to Gravity Forms or FreshDesk plugin endpoints containing serialized PHP data (e.g., O: patterns in request bodies); unexpected outbound connections from the web server to unknown external IPs.
• File System: Newly created or modified PHP files in the WordPress wp-content/uploads/ or plugin directories, particularly web shells (e.g., .php files with eval, base64_decode, or system functions).
• Logs: Web server access logs showing repeated or anomalous requests to plugin-specific endpoints with large or encoded POST bodies; PHP error logs referencing deserialization or object injection errors.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python.

WordPress site administrators should immediately update the WP Gravity Forms FreshDesk Plugin to version 1.3.6 or later, which addresses this vulnerability. If an immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing serialized PHP object patterns targeting plugin endpoints. Apply the principle of least privilege to the web server and database accounts, and monitor application and server logs for anomalous activity (Feedly, Patchstack).