What is the CVSS score of CVE-2025-60224?

CVE-2025-60224 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Subscribe to Download are affected by CVE-2025-60224?

A critical vulnerability in the WordPress plugin Subscribe to Download (versions 2.0.9 and earlier) allows an unauthenticated attacker to submit crafted input that can lead to full site compromise,…

How to fix or mitigate CVE-2025-60224?

Within 24 hours, inventory all WordPress installations running Subscribe to Download at version 2.0.9 or earlier, confirm which are internet-facing, and deactivate and remove the plugin where business operations permit; where removal is not immediately possible, place the affected sites behind a WAF or reverse proxy rule that blocks serialized-object payloads and POST requests to the plugin's endpoints. Within 7 days, for any site that must retain the plugin, isolate it behind authentication or IP allowlisting, harden the surrounding stack by updating WordPress core, all other plugins and themes to current versions (reducing the availability of usable POP gadget chains), enforce least-privilege file permissions, and enable file-integrity and PHP error logging with alerting on unserialize-related warnings. Within 30 days, complete migration to a maintained alternative download-gating plugin, verify no indicators of compromise on previously exposed sites (webshells, unexpected admin accounts, modified core files), and add a recurring third-party plugin risk review to your patch management process so unpatched critical components are flagged and removed within days rather than weeks; re-check the vendor advisory for a fixed release and apply it immediately if published.

Subscribe to Download CVE-2025-60224

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote unauthenticated (AV:N/PR:N/UI:N), but AC:H because exploitable impact depends on a usable POP gadget chain being present; full C/I/A impact when that condition is met.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:25 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe to Download: from n/a through <= 2.0.9.

AnalysisAI

PHP object injection in the WordPress plugin Subscribe to Download (versions up to and including 2.0.9) allows an unauthenticated remote attacker to pass crafted serialized input into an unsafe PHP unserialize() call, which can trigger magic-method execution and potentially lead to remote code execution, arbitrary file operations, or sensitive data disclosure depending on which gadget chains are reachable on the target. NVD rates the issue 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while an independent assessment applies AC:H because successful exploitation additionally depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin or theme; the practical risk is therefore highly site-dependent. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, with EPSS at 0.58% (46th percentile), indicating low observed exploitation likelihood despite the high base score.

Technical ContextAI

The flaw is a classic PHP Object Injection (CWE-502, deserialization of untrusted data) in the Subscribe to Download WordPress plugin, reported through Patchstack. WordPress plugins frequently serialize option values, form submissions, and subscriber metadata; when attacker-controlled input reaches PHP's unserialize() without restriction, an attacker can define arbitrary object properties and, if the classes autoloaded at that point contain exploitable magic methods such as __wakeup, __destruct, or __toString, chain them into a POP (property-oriented programming) gadget sequence. Object injection by itself is inert - its realized impact (RCE via code-execution gadgets, arbitrary file deletion/write, SQL injection, or information disclosure) is entirely determined by the gadget surface available in the plugin itself, WordPress core, and every other active plugin or theme. The affected CPE scope is the WordPress plugin subscribe-to-download through version 2.0.9, and the triggering parameter/endpoint is not identified in the available intelligence, which reduces the ability to write a precise detection signature. The divergence between the vendor-facing 9.8 score and the assessed AC:H vector reflects that while the entry point is network-reachable and requires no authentication or user interaction (PR:N/UI:N per the CVSS vector), exploitability is gated by gadget-chain availability rather than by the deserialization primitive alone.

Affected ProductsAI

The affected product is the WordPress plugin Subscribe to Download, all versions from the initial release through 2.0.9, running on any WordPress installation where the plugin is active; the CPE scope is the subscribe-to-download plugin up to and including 2.0.9. Because the plugin operates within the WordPress request lifecycle, any site exposing the plugin's public-facing download/subscription functionality is reachable. The vendor advisory is published in the Patchstack database at https://patchstack.com/database/Wordpress/Plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-php-object-injection-vulnerability?_s_id=cve. No other products or downstream distributions are identified in the available data.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis, so the primary mitigation is to deactivate and remove the Subscribe to Download plugin from any WordPress installation where it is not strictly required - this eliminates the vulnerable unserialize() path entirely and carries no side effects beyond loss of the plugin's download-gating functionality. If the plugin must remain active, restrict exposure by placing the site behind a WAF or reverse proxy with rules that flag serialized PHP payloads (O:digit:"..." patterns) in request parameters, though note this is signature-based and can be bypassed by encoding or object-syntax variations; alternatively, require authentication or IP allow-listing for any endpoints that accept the plugin's input, accepting that this may break legitimate anonymous subscriber flows. Reducing the available gadget surface helps limit impact rather than the bug itself: audit and remove unused or outdated plugins and themes, keep WordPress core and all extensions current so that known __destruct/__wakeup chains are patched, and deploy a PHP disable_functions / open_basedir hardening profile to blunt post-exploitation RCE (at the cost of compatibility with some legitimate functionality). Because the specific vulnerable parameter is unknown, also monitor web server and application logs for anomalous serialized strings and unexpected fatal errors from the plugin, and track the Patchstack advisory for an updated, patched release before reinstating the plugin.