What is the CVSS score of CVE-2025-60234?

CVE-2025-60234 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Single Property are affected by CVE-2025-60234?

The designthemes Single Property WordPress theme (versions through 2.8) contains a high-severity authenticated PHP object injection flaw that could allow a low-privilege user to fully compromise the…

How to fix or mitigate CVE-2025-60234?

Within 24 hours, inventory all WordPress installations for the designthemes Single Property theme at versions through 2.8, and if the theme is not business-critical, deactivate and remove it; restrict or disable new low-privilege user registrations and review existing accounts for least privilege, and enable logging or WAF rules to detect or block crafted serialized input. Within 7 days, monitor the vendor’s advisory channel for a vendor-released patch for versions through 2.8, and if one becomes available apply it immediately; if no patch is released, implement virtual patching or WAF signatures targeting PHP object injection, audit installed plugins and themes for usable POP gadget chains, and consider temporarily taking affected sites offline if they cannot be safely segregated. Within 30 days, if no vendor-released patch is identified, replace the Single Property theme with a maintained alternative or migrate affected sites to a supported platform, conduct a full compromise assessment of user accounts and logs, and maintain enhanced monitoring for suspicious deserialization or privilege escalation until a fixed version is available.

Single Property CVE-2025-60234

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N) exploitable with low complexity once a low-privilege account is held (PR:L), no interaction (UI:N); object injection yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:23 vuln.today

CVE Published

Oct 22, 2025 - 15:16 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8.

AnalysisAI

PHP object injection in the designthemes Single Property WordPress theme (versions through 2.8) lets an authenticated low-privilege user supply crafted serialized input that the theme deserializes without validation, potentially leading to full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only WordPress sites with the theme installed and active are affected, and per the assessed vector anonymous unauthenticated exploitation is not supported - a low-privilege account is required, with no user interaction and low attack complexity. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.53% (43rd percentile), though practical impact depends on whether a usable POP gadget chain exists in the theme or another installed plugin/theme.

Technical ContextAI

The flaw is CWE-502 (Deserialization of Untrusted Data) in a WordPress theme, the classic PHP Object Injection pattern: the theme passes attacker-influenced data to PHP's unserialize() (directly or via a wrapper such as maybe_unserialize()) without restricting allowed classes. Because WordPress ecosystems are densely interconnected, the real severity of CWE-502 depends on the availability of a Property-Oriented Programming (POP) gadget chain - a sequence of magic methods (__wakeup, __destruct, __toString, etc.) reachable across the theme core, bundled libraries, or any other active plugin/theme that can be chained from the injected object to reach a dangerous sink such as file write, SQL execution, or code evaluation. In the absence of such a chain, the injected object may only produce limited or unproven impact, which is the key practical limiter on this CVE. The affected component is identified through the vendor's Patchstack advisory for the WordPress theme 'Single Property' by designthemes; no CPE strings were supplied in the source data, so the affected identity rests on the vendor advisory and the version range (<= 2.8). The attack is remotely reachable (AV:N) and low complexity (AC:L), but requires a low-privilege authenticated session (PR:L) with no user interaction (UI:N).

Affected ProductsAI

The designthemes 'Single Property' WordPress theme, all versions from the initial release through and including 2.8, is affected when installed and active on a WordPress site. No CPE identifiers were provided in the available intelligence; product identification derives from the vendor/database advisory at https://patchstack.com/database/Wordpress/Theme/single-property/vulnerability/wordpress-single-property-theme-2-8-php-object-injection-vulnerability?_s_id=cve, which labels the issue as a PHP Object Injection vulnerability in the Single Property theme version 2.8. Any WordPress installation running this theme at or below 2.8 exposes the vulnerable code path; sites that have the theme installed but not activated may still carry the risk if its code is loadable. Note that because the exploitation vector requires an authenticated account, sites with open or loosely managed user registration and multiple low-privilege roles (subscribers, contributors, customers) have a larger practical exposure surface.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to upgrade the Single Property theme to the latest release above 2.8 as soon as designthemes publishes it, and to verify the fix through the vendor advisory at https://patchstack.com/database/Wordpress/Theme/single-property/vulnerability/wordpress-single-property-theme-2-8-php-object-injection-vulnerability?_s_id=cve. If an update is not yet available, deploy compensating controls that directly address the authenticated deserialization path: deactivate and delete the theme if it is not in active use (eliminating the attack surface entirely, at the cost of losing the site's property listings styling until an alternative theme is deployed); tighten user provisioning by disabling open registration and auditing existing low-privilege accounts, since PR:L means any subscriber-level account can attempt exploitation (trade-off: restricts legitimate self-service signups); and, if the site cannot function without it, deploy a WAF or application-level rule that inspects POST bodies and parameters for PHP-serialized payload markers such as 'O:' object tokens before they reach the theme (a signature-based mitigation that can be bypassed with encoding tricks and may cause false positives on legitimate serialized data). Additionally, minimize gadget-chain availability by removing unused plugins and themes, since the impact of object injection depends on a reachable POP chain; note this reduces but does not eliminate risk. Monitor the advisory for a patched version and apply it immediately once released.