What is the CVSS score of CVE-2025-60221?

CVE-2025-60221 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Captivate Sync are affected by CVE-2025-60221?

WordPress sites running the Captivate Sync plugin at version 3.0.3 or earlier are exposed to a critical-severity PHP object injection flaw that, if successfully triggered, could allow an…

How to fix or mitigate CVE-2025-60221?

Within 24 hours, run an inventory across all WordPress estates to identify every installation of Captivate Sync (plugin slug captivatesync-trade) at version 3.0.3 or earlier, and for any instance that is not business-essential, deactivate and delete the plugin immediately; for instances that must stay live, place them behind authentication or IP allow-listing and confirm the vulnerable deserialization endpoint is not publicly reachable. Within 7 days, deploy a web application firewall or reverse-proxy rule set that inspects and blocks PHP serialized object payloads (O: and C: patterns) on requests to the plugin's endpoints, back up and snapshot affected sites so they can be rebuilt cleanly, and notify site owners of the exposure and the absence of a vendor-released patch. Within 30 days, if no fixed version has been published, migrate the affected functionality to an alternative integration, or retire the plugin entirely and remove its files, then re-scan the estate to verify no instance of version 3.0.3 or earlier remains and add Captivate Sync to the standard patch-tracking watchlist so the site is upgraded the day a vendor fix becomes available.

Captivate Sync CVE-2025-60221

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated per the report, but PHP object injection requires a present POP gadget chain to achieve impact, so AC:H; full CIA loss assumed if exploited.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:25 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync: from n/a through <= 3.0.3.

AnalysisAI

PHP object injection in the WordPress plugin Captivate Sync (slug captivatesync-trade) through version 3.0.3 lets remote, unauthenticated attackers feed crafted serialized input into a PHP unserialize() path, which vendor/NVD scoring rates at CVSS 9.8 with full confidentiality, integrity and availability impact. Our independent assessment revises the vector to AC:H, because turning object injection into real impact requires a usable POP gadget chain in the plugin or another loaded component, and the available data does not confirm that such a chain exists. There is no public exploit identified at time of analysis, EPSS is low at 0.58% (46th percentile), the issue is not in CISA KEV, and real-world exposure is bounded by the plugin's narrow deployment footprint and by whether the vulnerable deserialization endpoint is reachable in a given configuration.

Technical ContextAI

The flaw is CWE-502, Deserialization of Untrusted Data, in a WordPress plugin. WordPress plugins are PHP components loaded inside the CMS request lifecycle, and this class of bug occurs when attacker-supplied data reaches PHP's unserialize() (or an equivalent wrapper such as maybe_unserialize()/unserialize() on request parameters, cookies, or stored options) without type or integrity validation. PHP's unserialize() instantiates objects named in the payload and invokes magic methods such as __wakeup(), __destruct(), __toString() and __call(); an attacker who can influence those object graphs can chain them into a POP (property-oriented programming) gadget chain that pivots object injection into file operations, SQL, or code execution. Note that object injection alone is not equivalent to code execution - impact is contingent on the availability of a suitable gadget chain in Captivate Sync, WordPress core, or another active plugin/theme. The supplied CPE and version data identify the affected component as the WordPress plugin Captivate Sync (captivatesync-trade) at versions up to and including 3.0.3; PatchesStack attributes the report to audit@patchstack.com and publishes a single vendor-database advisory, with no additional technical write-up or exploit analysis provided in the intelligence set.

Affected ProductsAI

Captivate Sync, the WordPress plugin distributed under the slug captivatesync-trade, is affected at all versions from n/a through 3.0.3 inclusive; the vendor database entry lists the plugin-3-0-3 release as the vulnerable artifact. No CPE string was included in the supplied data, so identification should rely on the WordPress plugin slug and installed plugin version rather than a formal CPE match. Site operators can enumerate exposure through the WordPress plugins list or WP-CLI (wp plugin list --status=active) using the captivatesync-trade slug. The only reference provided is the PatchesStack advisory at https://patchstack.com/database/Wordpress/Plugin/captivatesync-trade/vulnerability/wordpress-captivate-sync-plugin-3-0-3-php-object-injection-vulnerability?_s_id=cve, which is the authoritative vendor-database source for the affected version and any subsequently published fixed release.

RemediationAI

No vendor-released fixed version was identified in the provided data at time of analysis, so confirm the current patched release on the PatchesStack advisory page (https://patchstack.com/database/Wordpress/Plugin/captivatesync-trade/vulnerability/wordpress-captivate-sync-plugin-3-0-3-php-object-injection-vulnerability?_s_id=cve) and upgrade to it as soon as it is published; if no fix is available, the most reliable action is to deactivate, and ideally uninstall, the Captivate Sync (captivatesync-trade) plugin on any site that does not strictly need it, accepting the loss of the sync functionality it provides. Where the plugin must stay active, reduce the attack surface by restricting network access to the plugin's AJAX/REST/admin-ajax endpoints (for example, IP allow-listing or blocking unauthenticated POSTs to the plugin's routes), since the assessed vector is PR:N/UI:N and any unauthenticated reachable deserialization path is the primary exposure. Add a WAF rule that rejects request bodies containing PHP serialized object markers (for example, patterns matching O:<digit>:\"...\") on those endpoints, understanding that legitimate plugin payloads may be serialized and that such rules can cause false positives and break syncing. Because exploitation additionally depends on a usable POP gadget chain, shrinking the gadget surface helps: remove unused plugins and themes and keep WordPress core, all plugins and the PHP runtime patched, as this can break chains that would otherwise convert object injection into file write or code execution. Finally, monitor web and PHP logs for serialized payloads or unexpected object-instantiation errors targeting the plugin, and treat any such activity as attempted exploitation.