What is the CVSS score of CVE-2025-60226?

CVE-2025-60226 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of White Rabbit are affected by CVE-2025-60226?

A critical PHP object-injection flaw in the axiomthemes White Rabbit WordPress theme (versions through 1.5.2) exposes any site running the unpatched theme to unauthenticated remote attacks that could…

How to fix or mitigate CVE-2025-60226?

Within 24 hours, inventory all WordPress instances using the axiomthemes White Rabbit theme at version 1.5.2 or earlier, confirm the exposure scope with site owners, and where the theme is non-essential, deactivate and remove it immediately; for sites where removal is not feasible, place the affected theme behind a WAF or reverse-proxy rule that blocks serialized-object payloads (O: digit patterns) in request parameters and monitor for PHP unserialize warnings and unexpected object instantiation in logs. Within 7 days, engage the vendor (axiomthemes) for a remediation timeline and confirm no fix for the White Rabbit theme is available beyond version 1.5.2, review all active WordPress plugins and core versions for reachable POP gadget chains that would turn the injection into code execution, restrict administrative and author-level access to the minimum required, and enable file-integrity monitoring plus virtual patching from your WAF vendor if offered. Within 30 days, complete migration off the White Rabbit theme to a supported and actively maintained alternative, or, if the theme must remain, continue virtual patching and add continuous vulnerability scanning of the WordPress estate with alerting; validate that no compromise indicators (webshells, unauthorized admin accounts, outbound callbacks) exist on previously exposed sites, and fold the vulnerability into your periodic third-party component review so unmaintained themes and plugins are retired on a defined cadence.

White Rabbit CVE-2025-60226

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme White Rabbit

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated per vendor rating, but AC:H because reliable exploitation depends on the presence of a usable POP gadget chain; full C/I/A impact on RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:24 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.

AnalysisAI

PHP object injection in the axiomthemes White Rabbit WordPress theme through version 1.5.2 can allow remote attackers to pass crafted serialized data to a PHP unserialize() call, potentially causing object-injection side effects or code execution if a usable gadget chain exists. The vendor CVSS vector is 9.8 with PR:N/UI:N, suggesting unauthenticated remote exploitation, but our independent assessment raises attack complexity to High because successful code execution depends on a reachable POP chain in the theme, WordPress core, or an active plugin; no public exploit identified at time of analysis, no CISA KEV listing is present, and EPSS is low at 0.58% (46th percentile).

Technical ContextAI

The flaw is CWE-502, Deserialization of Untrusted Data, in a WordPress theme. The affected product is axiomthemes White Rabbit, identified by CPE cpe:2.3:a:axiomthemes:white_rabbit:*:*:*:*:*:wordpress:*:* for versions up to and including 1.5.2. In PHP, passing attacker-controlled input to unserialize() lets an attacker instantiate arbitrary objects and trigger magic methods such as __wakeup() or __destruct(); the practical severity depends on whether a POP gadget chain exists in the theme, WordPress core, or an installed plugin. The provided vendor CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but our independent assessment changes AC to High because the gadget-chain dependency limits reliable exploitation; without a reachable chain, impact may be limited to object instantiation side effects.

RemediationAI

Vendor-released patch: none identified in the provided data for White Rabbit through 1.5.2, so verify the Patchstack advisory for an update and apply it as soon as a patched theme version is released. If the theme is not essential, deactivate and remove it to eliminate exposure. Where it must remain, restrict access to the site, use a WAF with rules that block PHP serialized object payloads to the theme, and audit WordPress core and active plugins for known POP gadget chains that could turn object injection into code execution. Disabling the theme will break the site's appearance and functionality until a replacement is configured, and WAF virtual patching may not cover every attack path or may block legitimate serialized data.