PDF for Elementor Forms CVE-2025-60084
HIGHSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
AnalysisAI
PHP object injection in PDF for Elementor Forms plugin through version 6.5.0 allows authenticated attackers to execute arbitrary code or manipulate application logic via deserialization of untrusted data. While CVSS scores this 8.8 (High), real-world risk is tempered by authentication requirement (PR:L) and low EPSS score (0.06%, 19th percentile), indicating minimal observed exploitation attempts. No CISA KEV listing or public exploit code identified, suggesting attacks remain theoretical rather than widespread.
Technical ContextAI
This vulnerability stems from unsafe PHP deserialization (CWE-502) in the PDF for Elementor Forms WordPress plugin, which generates PDF documents from Elementor form submissions. PHP's unserialize() function can instantiate arbitrary objects when processing untrusted input, enabling attackers to trigger magic methods (__wakeup, __destruct) on existing classes in the WordPress environment. The plugin likely deserializes user-controlled data from form submissions or template configurations without proper validation. Affected component: add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder (wordpress-pdf-for-elementor-forms) versions up to and including 6.5.0. The Patchstack reference indicates this was identified through security audit rather than active exploitation.
Affected ProductsAI
Affected product: PDF for Elementor Forms + Drag And Drop Template Builder WordPress plugin (developed by add-ons.org) versions from earliest release through 6.5.0 inclusive. Vulnerability disclosed by Patchstack audit team. No vendor CPE string available in NVD data. Patchstack database entry: https://patchstack.com/database/Wordpress/Plugin/pdf-for-elementor-forms/vulnerability/wordpress-pdf-for-elementor-forms-drag-and-drop-template-builder-plugin-6-3-1-php-object-injection-vulnerability (note URL references 6.3.1 but CVE states 6.5.0 as latest affected version).
RemediationAI
Primary fix: Upgrade to PDF for Elementor Forms version 6.5.1 or later if available (verify current patched version at WordPress.org plugin repository or Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/pdf-for-elementor-forms/vulnerability/wordpress-pdf-for-elementor-forms-drag-and-drop-template-builder-plugin-6-3-1-php-object-injection-vulnerability). Immediate compensating controls if patch unavailable: restrict WordPress user account creation and review existing non-admin accounts, as exploitation requires authenticated access (PR:L). Remove or deactivate the plugin entirely if PDF generation from Elementor forms is not business-critical. Monitor WordPress audit logs for unusual form submission patterns or template modifications by low-privilege users. Note: Restricting user accounts trades functionality (legitimate user access) for security and may impact sites relying on subscriber/contributor roles.
Share
External POC / Exploit Code
Leaving vuln.today