What is the CVSS score of CVE-2025-60210?

CVE-2025-60210 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Everest Forms Frontend Listing are affected by CVE-2025-60210?

The Everest Forms - Frontend Listing WordPress plugin (versions through 1.0.5) contains a critical unauthenticated PHP object injection flaw that could let an external attacker gain control of any…

How to fix or mitigate CVE-2025-60210?

Within 24 hours, inventory every WordPress installation in the estate for the Everest Forms - Frontend Listing plugin and confirm the installed version; on any site running version 1.0.5 or earlier, deactivate and delete the plugin unless a documented business owner accepts the risk, and apply WAF or virtual patching rules that block serialized object payloads and suspicious POST parameters directed at the plugin's frontend listing endpoints. Within 7 days, complete removal or replacement of the plugin across all sites, add detection and alerting for PHP unserialize()-related errors and unexpected file changes under wp-content/plugins and wp-content/uploads, and enable WordPress auto-updates and integrity monitoring where operationally acceptable. Within 30 days, deploy a full WordPress component inventory process covering plugins and themes (including Everest Forms core) so that vulnerable gadgets are tracked and patched, and re-verify that no instance of Everest Forms - Frontend Listing through 1.0.5 remains in production, staging, or backup-driven restores.

Everest Forms Frontend Listing CVE-2025-60210

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin Everest Forms Frontend Listing

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network injection (AV:N/PR:N), but AC:H because meaningful impact requires a reachable POP gadget chain; full C/I/A retained as the worst-case object-injection outcome.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:27 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.

AnalysisAI

PHP Object Injection in the Everest Forms - Frontend Listing WordPress plugin (versions through 1.0.5) lets unauthenticated remote attackers feed attacker-controlled data into a PHP unserialize() sink, potentially triggering arbitrary object instantiation on the target site. The CVSS base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the reporter, while our independent assessment keeps the same scope of impact but raises attack complexity to High (AC:H) because a working exploitation path depends on an exploitable POP gadget chain being present in the plugin, Everest Forms core, or another active plugin or theme. EPSS is low at 0.50% (41st percentile), there is no KEV listing, and no public exploit code has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data, in a WordPress plugin context. PHP's unserialize() reconstructs objects from attacker-supplied strings and, when a matching class exists, invokes magic methods such as __wakeup(), __destruct(), and __toString(); a crafted serialized payload can chain these across loaded classes (a POP gadget chain) to reach dangerous sinks like file writes, arbitrary file deletion, SQL execution, or remote code execution. The CPE cpe:2.3:a:wpeverest:everest_forms_frontend_listing:*:*:*:*:*:wordpress:*:* confirms the affected component is the WordPress Frontend Listing add-on from vendor wpeverest, with no version constraint narrowing the range - implying all builds up to and including 1.0.5 are in scope. Because PHP object injection impact is contingent on the gadget surface available at runtime, the practical severity of this issue can be meaningfully lower (or higher) than the raw 9.8 score depending on the site's installed plugin and theme set; the unserialize sink itself is reachable without authentication in the reported configuration.

RemediationAI

No vendor-released patch was identified in the available data, so the primary action is to deactivate and remove the Everest Forms - Frontend Listing plugin from any exposed WordPress site until an update is published, then re-check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/everest-forms-frontend-listing/vulnerability/wordpress-everest-forms-frontend-listing-plugin-1-0-5-php-object-injection-vulnerability) for the fixed version. If the plugin cannot be removed, disable or unpublish any frontend listing functionality so user-controlled input no longer reaches the unserialize sink, accepting the loss of that feature as the trade-off. As compensating controls, deploy a WAF rule that inspects request parameters for PHP serialized object syntax (the O:<length>:"<ClassName>" pattern) and blocks it - with the caveat that this can cause false positives on legitimate serialized data and is bypassable via encoding tricks - and restrict access to any listing endpoints to trusted networks or authenticated roles using IP allowlisting or HTTP auth. Because exploitation typically requires a gadget chain from another installed component, inventory active plugins and themes for classes with dangerous magic methods and prioritize removing unused or unmaintained ones to reduce the attack surface.