What is the CVSS score of CVE-2025-60225?

CVE-2025-60225 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of BugsPatrol are affected by CVE-2025-60225?

A critical vulnerability in the AncoraThemes BugsPatrol WordPress theme (versions through 1.5.0) allows an unauthenticated attacker to trigger PHP object injection, which could escalate to remote…

How to fix or mitigate CVE-2025-60225?

Within 24 hours, inventory all WordPress installations using the AncoraThemes BugsPatrol theme up to and including version 1.5.0, confirm exposure against the vendor advisory, and immediately deactivate and remove the theme from any site that does not require it; for sites that must retain it, apply virtual patching at the WAF/edge layer to block crafted serialized-input requests targeting the theme's endpoints and restrict access to the affected paths. Within 7 days, if a functional business requirement forces continued use, isolate affected sites behind strict network and access controls, restrict write permissions on the WordPress filesystem, monitor logs for unexpected object instantiation or outbound connections, and confirm whether a patched theme version has been released since the advisory. Within 30 days, complete migration off BugsPatrol to a supported, actively maintained theme or implement equivalent server-side input validation that prevents untrusted data from reaching unserialize() calls, re-scan the environment to verify no residual vulnerable copies exist, and formalize a software inventory and third-party component review process to catch unsupported WordPress themes and plugins before they reach production.

BugsPatrol CVE-2025-60225

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network sink (AV:N/PR:N/UI:N), but AC:H because full impact depends on a reachable POP gadget chain; C/I/A:H reflect potential RCE if that condition is met.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:25 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <= 1.5.0.

AnalysisAI

PHP object injection in the AncoraThemes BugsPatrol WordPress theme (versions through 1.5.0) allows unauthenticated remote attackers to pass untrusted input to a PHP unserialize() call, enabling arbitrary object instantiation that can lead to remote code execution, file write, SQL injection, or data deletion if a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin. The initial CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment adjusts attack complexity to High (AC:H) because a viable gadget chain and reachable vulnerable code path are prerequisites for meaningful impact. EPSS is low at 0.59% (47th percentile), and no public exploit code or CISA KEV entry has been identified. No vendor-released patch or fixed version is identified in the provided advisory data at time of analysis.

Technical ContextAI

The vulnerability is a CWE-502 deserialization of untrusted data flaw in the AncoraThemes BugsPatrol WordPress theme, affecting versions up to and including 1.5.0. The theme passes attacker-controlled input to PHP's unserialize() function without adequate validation, allowing an attacker to inject a serialized PHP object. This enables arbitrary object instantiation, and the impact escalates to remote code execution, file write, SQL injection, or deletion only when a POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or another installed plugin. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed to reach the sink, but the independent assessment rates attack complexity as High (AC:H) because a usable gadget chain and reachable code path in the deployed configuration are necessary. The affected product is the BugsPatrol WordPress theme; no CPE string is provided in the input data. The advisory is published by Patchstack.

Affected ProductsAI

The AncoraThemes BugsPatrol WordPress theme, all versions from n/a through 1.5.0, is affected. The advisory is available at https://patchstack.com/database/Wordpress/Theme/bugspatrol/vulnerability/wordpress-bugspatrol-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve. No CPE string is provided in the input data. Sites running the BugsPatrol theme at or below version 1.5.0 are affected, provided the theme is installed and the vulnerable code path is reachable in the deployed configuration. The vulnerability is remotely exploitable without authentication or user interaction per the CVSS vector, but meaningful impact requires a usable POP gadget chain.

RemediationAI

No vendor-released patch or fixed version is identified in the provided advisory data at time of analysis. The primary mitigation is to remove or disable the BugsPatrol theme if it is not required, as deactivating the theme eliminates the vulnerable code path; this may affect site appearance and functionality. If the theme must remain active, restrict access to the site's front end and administrative interfaces to trusted networks or IP ranges via .htaccess, WAF rules, or a security plugin, though this is a compensating control with usability trade-offs and may not fully block exploitation. Monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/bugspatrol/vulnerability/wordpress-bugspatrol-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve for an update; if a patched version above 1.5.0 is released, upgrade immediately. As additional hardening, review installed plugins and themes for known POP gadget chains, since their presence raises the risk from object injection to remote code execution, file write, SQL injection, or deletion. Apply least-privilege database and file system permissions to limit the impact if exploitation succeeds.