What is the CVSS score of CVE-2025-60232?

CVE-2025-60232 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of KBx Pro Ultimate are affected by CVE-2025-60232?

KBx Pro Ultimate (knowledgebase-helpdesk-pro) through version 8.0.5 exposes WordPress sites to a critical unauthenticated PHP object injection vulnerability that could lead to full site compromise if…

How to fix or mitigate CVE-2025-60232?

Within 24 hours, inventory all WordPress sites for KBx Pro Ultimate (knowledgebase-helpdesk-pro) versions up to and including 8.0.5, and if found, disable or remove the plugin unless a documented compensating control is in place; restrict network access to plugin endpoints and monitor web logs for serialized payloads. Within 7 days, confirm whether a vendor patch has been released; because no vendor-released patch is identified at time of analysis, deploy virtual patching through a WAF or reverse proxy to block PHP object injection attempts, and review server hardening to limit gadget chain availability. Within 30 days, if no vendor patch is available, migrate to an alternative knowledgebase/helpdesk plugin or decommission the affected component, conduct a forensic review of exposed sites for signs of compromise, and update incident response plans to address unauthenticated deserialization risks.

KBx Pro Ultimate CVE-2025-60232

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

PHP object injection reachable over the network at low complexity with no stated auth (PR:N); successful gadget-chain exploitation can yield full C/I/A impact, matching the source vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:24 vuln.today

CVE Published

Oct 22, 2025 - 15:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.

AnalysisAI

Remote PHP object injection in KBx Pro Ultimate (knowledgebase-helpdesk-pro) up to version 8.0.5 allows attackers to supply crafted serialized data that the WordPress plugin deserializes without proper validation. The 9.8 CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, although the advisory does not explicitly confirm that the deserialization sink is reachable without authentication; defenders should verify exposure in their configuration. Practical code execution is gated on the presence of a usable PHP POP gadget chain, and no public exploit code has been identified at time of analysis; EPSS is low at 0.58% (46th percentile).

Technical ContextAI

The affected component is the WordPress plugin KBx Pro Ultimate (slug knowledgebase-helpdesk-pro), which provides knowledge base and helpdesk functionality. The vulnerability is a PHP object injection (CWE-502) where untrusted input is passed to a deserialization function such as unserialize() without restricting allowed classes. An attacker can craft a serialized payload that instantiates arbitrary PHP objects; if a property-oriented programming (POP) gadget chain exists in the plugin, WordPress core, or another loaded dependency, this can lead to remote code execution, file manipulation, or other severe impacts. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates it as unauthenticated network exploitation with low complexity, but the advisory does not detail the exact endpoint or confirm pre-auth reachability, and the independent assessment notes that effective exploitation is confined to sites running this specific plugin version and is gated on gadget-chain availability.

Affected ProductsAI

KBx Pro Ultimate (WordPress plugin slug knowledgebase-helpdesk-pro) versions from n/a through 8.0.5 are affected. No CPE identifiers are provided in the available intelligence. The vendor advisory is available at the Patchstack database: https://patchstack.com/database/Wordpress/Plugin/knowledgebase-helpdesk-pro/vulnerability/wordpress-kbx-pro-ultimate-plugin-8-0-5-php-object-injection-vulnerability?_s_id=cve

RemediationAI

The provided data does not specify an exact fixed version; consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/knowledgebase-helpdesk-pro/vulnerability/wordpress-kbx-pro-ultimate-plugin-8-0-5-php-object-injection-vulnerability?_s_id=cve) for patch availability and update KBx Pro Ultimate to a version later than 8.0.5 as soon as the vendor releases a fix. If a patch is not yet available, disable or remove the plugin-this eliminates the attack surface but loses knowledge base and helpdesk functionality. If the plugin must remain active, verify whether the vulnerable deserialization sink is reachable without authentication; if it is, block access to the specific endpoint using a web application firewall or server-level rules, though this requires knowing the exact path and may break legitimate functionality. Restricting administrative access to trusted IPs is advisable for admin-facing endpoints, but the CVSS vector indicates the issue may be unauthenticated, so this alone may not mitigate the core risk.