What is the CVSS score of CVE-2025-60039?

CVE-2025-60039 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Noisa WordPress Theme are affected by CVE-2025-60039?

The rascals 'Noisa' WordPress theme (versions through 2.6.0) contains a critical PHP Object Injection vulnerability that could allow unauthenticated remote attackers to compromise affected websites,…

How to fix or mitigate CVE-2025-60039?

Within 24 hours, inventory all WordPress sites using the rascals 'Noisa' theme and identify any running version through 2.6.0; consider temporarily disabling the theme or applying virtual patching via a web application firewall to block crafted serialized input. Within 7 days, monitor the vendor's website and WordPress security advisories for a patch, and evaluate alternative themes or custom code hardening to remove the vulnerable unserialize() call. Within 30 days, if no vendor patch is released, migrate to a supported theme or apply a custom patch, and conduct a security review of all WordPress installations to ensure no other vulnerable components exist. No vendor-released patch identified at time of analysis.

Noisa WordPress Theme CVE-2025-60039

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because meaningful impact requires a suitable POP gadget chain to be present; full C/I/A retained if that condition is met.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 23:52 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.

AnalysisAI

PHP Object Injection in the rascals 'Noisa' WordPress theme (versions through 2.6.0) lets a remote, unauthenticated attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling object injection (CWE-502). The published CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but our assessment raises attack complexity to High (AC:H) because a practical confidentiality/integrity/availability impact depends on an exploitable POP gadget chain existing in the theme, WordPress core, or a co-installed plugin. EPSS is only 0.56% (45th percentile), the issue is not listed in CISA KEV, and no public exploit code was identified at time of analysis; real-world exposure is further limited by the theme's niche install base and the gadget-chain prerequisite. Note that per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required to reach the vulnerable path.

Technical ContextAI

The flaw is CWE-502, Deserialization of Untrusted Data, in a PHP-based WordPress theme. WordPress themes frequently rely on PHP's serialize()/unserialize() for caching, options storage, or passing structured data, and when unserialize() is called on attacker-controllable input without an allowed_classes restriction, an attacker can instantiate arbitrary classes present in the loaded codebase. The direct primitive is object injection; the actual security impact only materializes when one of those classes defines magic methods such as __wakeup, __destruct, __toString, or __call that can be chained into a POP (property-oriented programming) gadget chain - for example to delete files, write files, or pivot into SQL or command execution. The affected component is the 'Noisa' theme distributed by the vendor rascals; the sole reference is the Patchstack WordPress vulnerability database entry for Noisa theme 2.6.0 (https://patchstack.com/database/Wordpress/Theme/noisa/vulnerability/wordpress-noisa-theme-2-6-0-php-object-injection-vulnerability?_s_id=cve), which classifies it as a PHP Object Injection issue. No CPE strings were supplied, so the affected scope is defined by the theme slug 'noisa' and the version ceiling rather than by a formal NVD CPE binding, and the CVSS vector (PR:N, UI:N) indicates the vulnerable deserialization path is reachable without credentials. Because WordPress sites typically co-install dozens of plugins, the presence of a usable gadget chain is environment-dependent, which is the basis for the independent assessment downgrading AC from Low to High.

Affected ProductsAI

The rascals 'Noisa' WordPress theme is affected in all versions from n/a through 2.6.0 inclusive (the described range is 'from n/a through <= 2.6.0', with 2.6.0 explicitly called out in the Patchstack advisory). The product is a third-party WordPress theme, so impacted sites are those where Noisa is installed and active on a WordPress instance; no CPE identifier was provided in the source data, and identification should be done by theme slug and version. The authoritative advisory for affected/fixed version mapping is the Patchstack entry at https://patchstack.com/database/Wordpress/Theme/noisa/vulnerability/wordpress-noisa-theme-2-6-0-php-object-injection-vulnerability?_s_id=cve. Sites running Noisa 2.6.0 or earlier whose theme code contains a deserialization path for attacker-controlled input should be considered exposed, particularly if the site also runs plugins that supply usable unserialize gadget classes.

RemediationAI

Apply the fixed Noisa release from the theme vendor (rascals) as soon as it is published; the provided data does not specify an exact patched version number, so consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/noisa/vulnerability/wordpress-noisa-theme-2-6-0-php-object-injection-vulnerability?_s_id=cve for the version mapping and upgrade the theme from 2.6.0 (or earlier) to the latest available release - do not attempt to install a version number that is not confirmed by the vendor, since Patch status is 'no exact fix version confirmed in the available data' rather than 'no patch exists'. If no fixed release is yet available, the most direct compensating control is to deactivate and remove the Noisa theme from production sites (trade-off: loss of the theme's presentation and any theme-specific functionality, and child themes depending on it will break) until a patched version ships. Additional hardening: enforce a web application firewall rule or reverse-proxy filter that blocks request bodies containing PHP serialized object patterns (e.g., 'O:' followed by a length and class name) from reaching the theme, accepting that this can cause false positives and will not stop exploits delivered through non-HTTP paths; audit co-installed plugins and WordPress core for known POP gadget classes and remove or update unused plugins, since eliminating gadget chains reduces the blast radius of any object injection (trade-off: plugin removal may break site features, and this only mitigates impact rather than the underlying unserialize of untrusted input); and restrict administrative and debug endpoints that might expose additional deserialization surfaces. Where practical, keep the WordPress core, all themes, and all plugins on current versions so that known gadget chains are patched, and monitor the Patchstack advisory and vendor channel for the confirmed fixed Noisa version so the temporary controls can be replaced with the real patch.