What is the CVSS score of CVE-2025-60212?

CVE-2025-60212 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of VEDA WordPress Theme are affected by CVE-2025-60212?

The VEDA WordPress theme (versions through 4.2) contains a high-severity PHP object injection vulnerability that could allow authenticated low-privilege users to achieve high confidentiality,…

How to fix or mitigate CVE-2025-60212?

Within 24 hours, inventory all WordPress installations using the VEDA theme version 4.2 or earlier, and if the theme is not business-critical, deactivate and remove it; also restrict low-privilege user accounts to only trusted personnel. Within 7 days, deploy a web application firewall (WAF) with rules to detect and block PHP object injection attempts, review user roles to minimize authenticated access, and monitor server logs for suspicious deserialization activity. Within 30 days, if no vendor patch is available, evaluate replacing the VEDA theme with a maintained alternative, and conduct a security review of co-installed plugins to identify potential gadget chains; continue monitoring the vendor's advisory for a patch release.

VEDA WordPress Theme CVE-2025-60212

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress input with low complexity and no user interaction; object injection needs a low-privilege authenticated account (PR:L), and a gadget chain can yield full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:27 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.

AnalysisAI

Authenticated attackers with low privileges can exploit a PHP object injection flaw in the VEDA WordPress theme through version 4.2, potentially achieving high confidentiality, integrity, and availability impact if a usable gadget chain exists in the theme or co-installed plugins. The vulnerability stems from deserialization of untrusted data (CWE-502) and carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and EPSS is 0.53% (43rd percentile), indicating limited near-term exploitation likelihood.

Technical ContextAI

The issue is a PHP Object Injection (CWE-502) in the designthemes VEDA theme. WordPress themes are PHP applications; when user-supplied data is passed to unserialize() without adequate validation, an attacker can inject serialized objects. If magic methods such as __wakeup, __destruct, or __toString are defined by classes in the theme or co-installed plugins, these can form a gadget chain that triggers unintended actions, potentially leading to code execution, file operations, or data manipulation. The CVSS vector confirms network reachability with low privileges required and no user interaction, but successful impact depends on a reachable gadget sink. The available data does not identify the exact vulnerable input or parameter; CPE strings were not provided. The Patchstack advisory is the source reference.

Affected ProductsAI

The designthemes VEDA WordPress theme is affected in all versions up to and including 4.2 (<= 4.2), per the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/veda/vulnerability/wordpress-veda-theme-4-2-php-object-injection-vulnerability?_s_id=cve. No CPE string was provided in the input data. Sites running the VEDA theme at version 4.2 or earlier on WordPress are in scope; the vulnerability requires at least a low-privileged authenticated account on the target site.

RemediationAI

No vendor-released patch identified at time of analysis. If the VEDA theme is not essential, disable and remove it, or replace it with a maintained theme; this removes the vulnerable code but changes site appearance and functionality. If it must remain, restrict and review low-privileged WordPress accounts, since exploitation requires PR:L, and remove unused accounts to reduce attack surface. Because impact depends on a PHP gadget chain, reducing the number of installed plugins/themes can eliminate gadget sinks, though this may break site features. There is no documented vulnerable input/parameter in the available data, so input-specific filtering is not feasible from this intelligence alone; deploy virtual patching or a WAF rule for PHP object injection if the hosting provider offers it, and monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/veda/vulnerability/wordpress-veda-theme-4-2-php-object-injection-vulnerability?_s_id=cve for a fixed version. Do not treat the absence of a patch as confirmation that none will be released.