What is the CVSS score of CVE-2025-60215?

CVE-2025-60215 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of designthemes Kriya are affected by CVE-2025-60215?

The Kriya WordPress theme, deployed across all versions up to and including 3.4, contains a PHP object injection flaw that allows any authenticated low-privilege user - such as a subscriber or…

How to fix or mitigate CVE-2025-60215?

Within 24 hours, inventory every WordPress installation running the designthemes Kriya theme at version 3.4 or earlier and confirm whether user self-registration, guest author, or any low-privilege role provisioning is enabled; where Kriya is non-essential, deactivate and remove the theme immediately, and where it must remain, restrict account creation and reduce the number of low-privilege accounts to the minimum necessary. Within 7 days, apply the principle of least privilege by auditing subscriber, contributor, and author roles, disabling open registration, enforcing multi-factor authentication for all accounts, and deploying a WordPress-aware web application firewall or virtual patching rule that blocks crafted serialized payloads targeting theme input parameters; also scan the site for installed plugins and themes that could supply a usable gadget chain, since the severity of this flaw depends on their presence. Within 30 days, if the vendor has published a fixed Kriya version, test and deploy it through change control; if no fix is available, migrate to a supported alternative theme, add runtime monitoring for unexpected object instantiation and file changes, and re-validate that no unauthenticated or low-privilege path reaches the vulnerable unserialize() call. Note that no vendor-released patch has been identified at time of analysis and no public exploit code has been identified at time of analysis, so these actions are precautionary hardening rather than incident response.

designthemes Kriya CVE-2025-60215

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable deserialization needs a valid low-privilege account (PR:L) and no interaction (UI:N); successful object injection yields high C/I/A impact within the same scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:26 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.

AnalysisAI

PHP object injection in the designthemes Kriya WordPress theme (all versions up to and including 3.4) lets an authenticated low-privilege user pass crafted serialized input into an unserialize() call and instantiate arbitrary PHP objects on the server. Successful exploitation can yield full compromise of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though real-world impact is gated by the availability of a usable gadget/POP chain in WordPress core or other installed plugins, without which the flaw is limited to object injection. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.53% (43rd percentile), and no fixed version is confirmed in the available data.

Technical ContextAI

The issue is a classic PHP Object Injection (CWE-502, Deserialization of Untrusted Data) in a WordPress theme. Some code path in Kriya 3.4 and earlier passes attacker-controllable input to PHP's unserialize() without an allowed_classes constraint, allowing an attacker to reconstruct arbitrary object graphs. PHP's magic methods (__wakeup, __destruct, __toString, __call) then fire automatically during object destruction or string conversion, and a property-oriented programming (POP) gadget chain assembled from classes already loaded by WordPress core, the theme, or any active plugin can turn that into file writes, arbitrary file deletion, SQL injection, or remote code execution. Object injection in isolation is not automatically code execution: exploitability depends on the presence of a suitable gadget chain in the runtime class set, which varies per site. The affected product is the designthemes Kriya theme distributed through the WordPress ecosystem; the CVSS vector confirms network reachability, low attack complexity, low-privilege authentication (PR:L), no user interaction, and no scope change. The only supplied reference is the Patchstack WordPress theme vuln database entry.

Affected ProductsAI

The designthemes Kriya WordPress theme, versions from the initial release through 3.4 inclusive, is affected; the vendor/version field in the NVD description reads 'from n/a through <= 3.4'. Any WordPress installation with the Kriya theme active at version 3.4 or earlier is potentially exposed, and because the flaw requires authentication, sites that permit self-registration, low-privilege subscriber/contributor/author accounts, or that host many accounts have a broader exposure surface. No structured CPE string was provided in the source data, so exact platform enumeration should be verified against the vendor advisory; the authoritative reference is the Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/kriya/vulnerability/wordpress-kriya-theme-3-4-php-object-injection-vulnerability. WordPress itself, its plugins, and other themes are not the affected component, although active plugins heavily influence whether an exploitable gadget chain exists on a given site.

RemediationAI

No vendor-released patch version is confirmed in the provided data; the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/kriya/vulnerability/wordpress-kriya-theme-3-4-php-object-injection-vulnerability) should be checked for an updated theme release, and administrators should apply the latest Kriya version as soon as an update that fixes the unserialize() sink is published. If no fix is available, the highest-confidence mitigation is to deactivate and remove the Kriya theme entirely and replace it with a maintained alternative, accepting the loss of the theme's design and functionality. Where removal is not feasible, reduce the attack surface by disabling open registration and locking down or auditing low-privilege accounts (subscribers, contributors, authors), since PR:L confirms valid credentials are mandatory and blocking untrusted account creation removes the prerequisite; the trade-off is restricted site workflows and the need to regularly review existing users. Additionally, enforce an allow-list approach for classes in any theme code that calls unserialize() (passing ['allowed_classes' => false] where the data is only meant to be arrays/scalars), and deploy WAF rules that inspect request bodies and parameters for PHP serialization markers such as 'O:' object strings bound for the vulnerable endpoint. Finally, minimize installed plugins to shrink the set of classes available for a POP gadget chain, monitor logs for anomalous serialized payloads, and rotate credentials if compromise is suspected.