What is the CVSS score of CVE-2025-60238?

CVE-2025-60238 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-60238?

The UNIVERSAM WordPress plugin (versions ≤9.03) contains a critical PHP object injection vulnerability that allows unauthenticated remote attackers to execute arbitrary code, access sensitive data,…

How to fix or mitigate CVE-2025-60238?

Within 24 hours: Inventory all WordPress instances using UNIVERSAM plugin and document current versions. Within 7 days: Contact plugin vendor for security guidance; if no patch timeline is provided, disable or remove the plugin entirely and identify functional alternatives. Within 30 days: Implement Web Application Firewall (WAF) rules to block PHP deserialization patterns from untrusted sources; conduct forensic review of server logs for exploitation indicators (POST requests with serialized PHP objects).

Wordpress Plugin CVE-2025-60238

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.03.

AnalysisAI

PHP object injection in UNIVERSAM WordPress plugin through deserialization of untrusted data allows remote unauthenticated attackers to achieve critical impact including remote code execution, complete data compromise, and denial of service. Affects all versions up to and including 9.03. EPSS exploitation probability is relatively low at 0.10% (28th percentile), with no public exploit identified at time of analysis, suggesting a lower immediate real-world risk despite the critical CVSS 9.8 score.

Technical ContextAI

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a dangerous flaw where applications deserialize user-controlled input without proper validation. In PHP environments, particularly WordPress plugins, unsafe deserialization can allow attackers to instantiate arbitrary objects with attacker-controlled properties. The UNIVERSAM WordPress plugin (universam-demo) processes serialized PHP data from untrusted sources without sanitization, enabling object injection attacks. When PHP unserializes malicious payloads, magic methods like __wakeup(), __destruct(), or __toString() can be invoked on injected objects, potentially triggering arbitrary code execution if vulnerable classes exist in the application's codebase (often called 'gadget chains'). WordPress environments are particularly susceptible due to the extensive class libraries available for chaining exploits.

Affected ProductsAI

This vulnerability affects the UNIVERSAM WordPress plugin (also identified as universam-demo) in all versions from the initial release through version 9.03 inclusive. The plugin appears to be developed by universam, with the vulnerable component handling deserialization operations. Organizations should verify installed versions through WordPress admin panel under Plugins section. The Patchstack database reference at https://patchstack.com/database/Wordpress/Plugin/universam-demo/ provides authoritative affected version information, confirming the version ceiling of 9.03 as the last known vulnerable release.

RemediationAI

Organizations running UNIVERSAM plugin version 9.03 or earlier should immediately update to a patched version if available from the WordPress plugin repository or vendor. Check the official WordPress plugin directory and vendor communications for release notes confirming deserialization vulnerability fixes. If no patched version is publicly released, temporarily disable and remove the UNIVERSAM plugin until a security update becomes available, evaluating whether plugin functionality is business-critical. For WordPress installations where removal is not feasible, implement web application firewall (WAF) rules to inspect and block serialized PHP payloads in HTTP requests, and restrict plugin access to authenticated administrators only through WordPress role-based access controls. Monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/universam-demo/vulnerability/wordpress-universam-plugin-8-72-14-php-object-injection-vulnerability for updated remediation guidance and confirmed fix versions. Conduct security audit of any WordPress installation where this plugin was active to identify potential historical compromise indicators.