What is the CVSS score of CVE-2025-60213?

CVE-2025-60213 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Scape Theme are affected by CVE-2025-60213?

Organizations using the Whitebox-Studio Scape WordPress theme (versions up to 1.5.13) are exposed to a critical PHP object injection vulnerability that could allow unauthenticated attackers (per NVD…

How to fix or mitigate CVE-2025-60213?

Within 24 hours, inventory all WordPress sites for the Whitebox-Studio Scape theme version 1.5.13 or earlier and consider temporarily disabling or removing the theme if not essential; if it must remain active, deploy WAF virtual patching to block PHP object injection attempts and monitor logs for suspicious unserialize activity. Within 7 days, verify whether a vendor patch has been released (currently none available), restrict administrative access, enable two-factor authentication, and review co-installed plugins for known POP gadget chains. Within 30 days, if no patch is available, migrate to an alternative theme or implement a code-level fix by replacing unserialize() with safe deserialization methods, and conduct a forensic review for indicators of compromise.

Scape Theme CVE-2025-60213

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable object injection, but I set AC:H because meaningful impact depends on a usable POP gadget chain; PR:N retained since no authentication requirement is stated, though this is unverified.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:26 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.

AnalysisAI

PHP object injection affects the Whitebox-Studio Scape WordPress theme through version 1.5.13, where attacker-supplied data reaches a PHP unserialize() call and can be turned into remote code execution, file write, or SQL injection if a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin. The NVD vector rates the flaw 9.8 (AV:N/AC:L/PR:N), but the assessed vector is 8.1 (AC:H) because the exact vulnerable feature and the availability of a working gadget chain are not documented, and the PR:N rating is not corroborated by any detail in the advisory. Exploitation risk is otherwise low: EPSS is 0.58% (46th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data, in the Scape WordPress theme. WordPress themes are PHP applications that run inside the WordPress request lifecycle, so any theme code that passes user-controlled input to unserialize() gives an attacker the ability to instantiate arbitrary PHP objects and control their properties. The impact of such object injection is not automatic: it depends on the presence of a POP (property-oriented programming) gadget chain in the theme itself, in WordPress core, or in any active plugin, where magic methods such as __wakeup(), __destruct(), or __toString() on a reachable class perform a dangerous action. Because WordPress sites typically run many plugins, gadget availability is site-specific, which is why the assessed vector lowers the attack complexity rating to AC:H compared with the vendor/CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H score of 9.8. The advisory comes from Patchstack, and the NVD entry points to the same Patchstack database record; no CPE identifiers, sink location, or affected parameter were supplied in the input, and no patch or fixed version is referenced.

Affected ProductsAI

The affected product is the Whitebox-Studio Scape WordPress theme, all versions from n/a through 1.5.13 inclusive, identified in the advisory slug as the Scape theme 1.5.13 PHP object injection vulnerability. Any WordPress installation with the vulnerable Scape theme active or installed is in scope. No CPE strings were provided in the input data. The single authoritative reference is the Patchstack database advisory at https://patchstack.com/database/Wordpress/Theme/scape/vulnerability/wordpress-scape-theme-1-5-13-php-object-injection-vulnerability?_s_id=cve, which is the recommended source for the current fixed version and detection guidance; because no fixed version is stated in the supplied data, administrators should confirm the latest release directly from the theme vendor or that advisory.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so the primary action is to treat the theme as vulnerable until the vendor publishes a fix and to verify the current status on the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/scape/vulnerability/wordpress-scape-theme-1-5-13-php-object-injection-vulnerability?_s_id=cve. If the theme is not essential, deactivate and delete it entirely; this is the only mitigation that fully removes the unserialize() sink, at the cost of losing the site's design and any theme-dependent templates. If the theme must stay active, apply virtual patching through a WAF or a WordPress security product that has a rule for this Scape object injection advisory, accepting that WAF coverage of theme-level sinks is pattern-dependent and can be bypassed by obfuscated payloads. Reduce gadget-chain availability by keeping WordPress core and all plugins fully patched and by removing unused plugins, since the likelihood of converting object injection into code execution depends on which gadget classes remain reachable. Restrict untrusted input to the affected endpoints where they can be identified, monitor web logs and file integrity for unexpected object serialization payloads (O: or a: patterns in request bodies and parameters), and re-check the Patchstack record for a patched theme release before restoring normal operation.