CVE-2025-60224: 
WordPress vulnerability analysis and mitigation

CVE-2025-60224 is a Deserialization of Untrusted Data (PHP Object Injection) vulnerability in the wpshuffle "Subscribe to Download" WordPress plugin. It affects all versions up to and including 2.0.9, and was reported by researcher João Pedro S Alcântara (Kinorth) on June 4, 2025, with public disclosure on July 4, 2025, and CVE assignment on October 22, 2025. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and maps to CAPEC-586 (Object Injection). The plugin fails to properly validate or sanitize user-supplied data before passing it to PHP's deserialization functions, allowing an unauthenticated remote attacker to inject arbitrary PHP objects. If a suitable Property-Oriented Programming (POP) chain exists within the WordPress environment (either in the plugin itself or in other installed plugins/themes), this object injection can be escalated to remote code execution, SQL injection, path traversal, or denial of service (Patchstack).

Successful exploitation can result in complete compromise of the affected WordPress site, including unauthorized remote code execution, data theft, SQL injection, and path traversal, depending on available POP chains in the environment. All three security pillars — confidentiality, integrity, and availability — are rated HIGH, meaning an attacker could exfiltrate sensitive data, modify site content or databases, and render the site unavailable. No authentication is required, making every publicly accessible WordPress site running the vulnerable plugin a potential target (Patchstack, NVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Patchstack). The vulnerability is unauthenticated and network-accessible (no privileges or user interaction required), which significantly lowers the barrier for exploitation. The EPSS score is approximately 0.042%, indicating a currently low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. Patchstack has flagged it as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Subscribe to Download" plugin version ≤ 2.0.9 using tools like WPScan, Shodan, or Censys by fingerprinting plugin assets (e.g., /wp-content/plugins/subscribe-to-download/).
2. Identify deserialization entry point: Analyze the plugin's source code or network traffic to locate the parameter or endpoint that accepts serialized PHP data without sanitization.
3. Craft malicious serialized payload: Using a tool such as PHPGGC, generate a PHP object injection payload targeting a known POP chain available in the WordPress environment (e.g., from commonly installed plugins or WordPress core classes).
4. Submit payload: Send a crafted HTTP request (GET or POST) to the vulnerable endpoint with the malicious serialized object embedded in the relevant parameter.
5. Trigger deserialization: The plugin deserializes the attacker-controlled data, instantiating the injected object and invoking magic methods (__wakeup, __destruct, etc.) that execute the POP chain.
6. Achieve objective: Depending on the POP chain, the attacker may achieve remote code execution, write a web shell, exfiltrate database credentials, or perform other malicious actions on the WordPress site (Patchstack).

• Network: Unusual HTTP requests to plugin-specific endpoints (e.g., paths under /wp-content/plugins/subscribe-to-download/) containing serialized PHP data patterns (e.g., strings beginning with O:, a:, s: typical of PHP serialization).
• Logs: WordPress or web server access logs showing repeated or anomalous POST/GET requests to subscribe-to-download plugin endpoints with large or encoded payloads; PHP error logs showing unexpected object instantiation or magic method invocations.
• File System: Newly created or modified PHP files in the WordPress installation directory (especially web shells); unexpected files in /wp-content/uploads/ or plugin directories.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) indicating command execution via a POP chain.
• Database: Unexpected changes to WordPress options, user accounts, or administrator credentials in the wp_options or wp_users tables.

The vendor (wpshuffle) has released version 2.1.0 of the Subscribe to Download plugin, which patches this vulnerability. All users should update immediately to version 2.1.0 or later via the WordPress plugin dashboard. If an immediate update is not possible, the plugin should be temporarily deactivated to eliminate the attack surface. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. Additionally, administrators should review their WordPress environment for unnecessary plugins that may contribute POP chain gadgets, and apply the principle of least privilege to the hosting environment (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher João Pedro S Alcântara (Kinorth), classified it as high priority and noted that PHP Object Injection vulnerabilities of this severity are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media discussion has been identified at this time (Patchstack).