What is the CVSS score of CVE-2025-60216?

CVE-2025-60216 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Theme are affected by CVE-2025-60216?

BoldThemes Addison WordPress theme versions before 1.4.8 contain a critical PHP object injection vulnerability (CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code on…

How to fix or mitigate CVE-2025-60216?

Within 24 hours: Identify all WordPress sites using BoldThemes Addison theme and document current versions via theme settings or wp-admin inspection. Within 7 days: Update BoldThemes Addison theme to version 1.4.8 or later on all affected installations. Within 30 days: Conduct security audit of affected WordPress sites for unauthorized access, malicious code, or data exfiltration during vulnerability window.

Wordpress Theme CVE-2025-60216

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8.

AnalysisAI

PHP object injection in BoldThemes Addison WordPress theme versions prior to 1.4.8 enables unauthenticated remote attackers to execute arbitrary code through unsafe deserialization. The vulnerability carries a critical CVSS 9.8 score with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, with EPSS indicating 10th percentile exploitation probability (0.10%), suggesting low observed exploitation likelihood despite high theoretical severity.

Technical ContextAI

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data) affecting the Addison WordPress theme by BoldThemes. PHP object injection occurs when an application unserializes user-controlled data without proper validation, allowing attackers to instantiate arbitrary PHP objects. If the application contains gadget chains (existing classes with magic methods like __wakeup, __destruct, or __toString), attackers can chain these together to achieve code execution, SQL injection, or file manipulation. WordPress themes frequently handle serialized data for configuration storage, theme options, or custom post types. The vulnerability exists in versions up to and including 1.4.7, indicating a long-standing code pattern that persisted across multiple releases before detection and remediation.

Affected ProductsAI

This vulnerability affects BoldThemes Addison WordPress theme in all versions from the initial release through version 1.4.7. The Patchstack advisory specifically documents the flaw in version 1.4.2, indicating the vulnerability existed across multiple release cycles. Organizations running any Addison theme version prior to 1.4.8 should consider themselves affected. The vulnerability was reported through Patchstack's coordinated disclosure program (audit@patchstack.com), suggesting responsible disclosure practices were followed. The vendor advisory and technical details are available at https://patchstack.com/database/Wordpress/Theme/addison/vulnerability/wordpress-addison-theme-1-4-2-php-object-injection-vulnerability.

RemediationAI

Organizations must immediately upgrade the BoldThemes Addison WordPress theme to version 1.4.8 or later, which addresses the unsafe deserialization vulnerability. Navigate to WordPress admin dashboard, select Appearance > Themes, check for available updates, and apply the Addison 1.4.8 update. For environments where immediate patching is not feasible, implement defense-in-depth controls including Web Application Firewall (WAF) rules to inspect and block serialized PHP objects in POST/GET parameters, restrict theme file write permissions, and monitor for suspicious deserialization attempts in PHP error logs. Organizations no longer using Addison should deactivate and remove the theme entirely to eliminate the attack surface. Complete remediation guidance and technical details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/addison/vulnerability/wordpress-addison-theme-1-4-2-php-object-injection-vulnerability. Verify successful remediation by confirming theme version 1.4.8 or later in WordPress admin panel.