Cyber Posture

CVE-2025-60081

High

Published: 18 December 2025

Published
18 December 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE by requiring identification, reporting, and timely patching of the deserialization flaw in the PDF for Contact Form 7 plugin.

prevent

Mandates validation of untrusted inputs to block malicious data deserialization leading to object injection in the plugin.

prevent

Controls and verifies user-installed software like the vulnerable WordPress plugin prior to deployment to prevent exploitation.

Security SummaryAI

CVE-2025-60081 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the PDF for Contact Form 7 WordPress plugin from add-ons.org, specifically the pdf-for-contact-form-7 component. This issue enables Object Injection and affects all versions from n/a through 6.5.0. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited remotely by an authenticated attacker with low privileges, such as a standard WordPress user, requiring low attack complexity and no user interaction. Successful exploitation allows high-impact consequences across confidentiality, integrity, and availability, potentially enabling object injection to execute arbitrary code or manipulate server-side data.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/pdf-for-contact-form-7/vulnerability/wordpress-pdf-for-contact-form-7-plugin-6-3-0-deserialization-of-untrusted-data-vulnerability?_s_id=cve provides details on the flaw, referencing version 6.3.0 within the affected range up to 6.5.0. Security practitioners should review the advisory for mitigation guidance, including any available patches or workarounds, and prioritize updating the plugin.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Deserialization vulnerability in a WordPress plugin enables remote exploitation by low-privileged authenticated users for arbitrary code execution, directly mapping to exploitation of public-facing web applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References