What is the CVSS score of CVE-2025-60228?

CVE-2025-60228 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Knowledge Base Theme are affected by CVE-2025-60228?

The designthemes Knowledge Base WordPress theme, deployed on sites running versions up to and including 2.9, contains a high-severity PHP object injection flaw that could let a low-privilege account…

How to fix or mitigate CVE-2025-60228?

Within 24 hours, inventory all WordPress installations using the designthemes Knowledge Base theme (versions up to and including 2.9) and confirm whether any untrusted or low-privilege users can register; if the theme is not essential, deactivate and remove it immediately. Within 7 days, if removal is not feasible, restrict registration and tighten role assignments to eliminate low-privilege accounts on affected sites, enable a web application firewall with virtual patching for PHP object injection patterns, and monitor the vendor's channel for a fixed release. Within 30 days, if no vendor patch has been issued, migrate to an alternative knowledge base theme or plugin, and maintain compensating controls until a fixed version is available; re-verify all affected sites after remediation.

Knowledge Base Theme CVE-2025-60228

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable unserialize sink reached with a low-privilege account (PR:L), no user interaction, and object injection can yield full code execution giving high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:24 vuln.today

CVE Published

Oct 22, 2025 - 15:16 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.

AnalysisAI

PHP object injection in the designthemes Knowledge Base WordPress theme (versions up to and including 2.9) allows an authenticated low-privilege user to pass untrusted serialized data into a PHP unserialize() call, which can lead to object injection and potentially full confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target site (CVSS PR:L), and real-world impact is further gated by the presence of a usable POP/gadget chain in the theme, WordPress core, or co-installed plugins. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); EPSS is low at roughly 0.53% (43rd percentile), reflecting limited observed activity.

Technical ContextAI

The flaw is a CWE-502 Deserialization of Untrusted Data issue in the designthemes Knowledge Base WordPress theme. An attacker-supplied serialized string reaches a PHP unserialize() call without adequate validation, allowing PHP Object Injection: the attacker can instantiate arbitrary classes and, if a Property-Oriented Programming (POP) gadget chain is reachable, chain magic methods (__wakeup, __destruct, __toString) into harmful behavior such as file operations or code execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity attack that requires an authenticated low-privilege account (PR:L) with no user interaction, scoped to the vulnerable component, and rated High on confidentiality, integrity, and availability. Because the exploitability ceiling depends on gadget availability, the practical severity on any given site hinges on which plugins and core version are co-installed alongside the theme.

Affected ProductsAI

The designthemes Knowledge Base WordPress theme (kbase), all versions from n/a through 2.9 inclusive, is affected. No CPE identifiers were supplied in the source data, but the product corresponds to a WordPress theme published by designthemes. The sole reference is the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/kbase/vulnerability/wordpress-knowledge-base-theme-2-9-php-object-injection-vulnerability?_s_id=cve, and the vulnerability was reported by audit@patchstack.com. Any WordPress installation running this theme at or below version 2.9 should be treated as exposed.

RemediationAI

No vendor-released patch was identified in the available data at time of analysis, so remediation depends on compensating controls. The most direct mitigation is to replace or remove the designthemes Knowledge Base theme until an updated version is published, accepting the resulting loss of the theme's custom functionality. If the theme must remain, tightly restrict account provisioning so that only fully trusted administrators hold any role above subscriber, since exploitation requires an authenticated low-privilege account (PR:L) and removing low-privilege login capability eliminates the attack precondition. Reducing the installed plugin set lowers the probability that a usable POP gadget chain exists, at the cost of losing those plugins' features. Deploying a WAF or application-level filtering that rejects serialized payloads (for example patterns containing O: or C: tokens) in theme-reachable request parameters can interrupt the attack, though such signatures may be bypassed and could cause false positives on legitimate content. Monitor the Patchstack advisory page (https://patchstack.com/database/Wordpress/Theme/kbase/vulnerability/wordpress-knowledge-base-theme-2-9-php-object-injection-vulnerability?_s_id=cve) for an official fixed release and apply it as soon as it becomes available.