CVE-2025-60081
Published: 18 December 2025
Description
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring identification, reporting, and timely patching of the deserialization flaw in the PDF for Contact Form 7 plugin.
Mandates validation of untrusted inputs to block malicious data deserialization leading to object injection in the plugin.
Controls and verifies user-installed software like the vulnerable WordPress plugin prior to deployment to prevent exploitation.
Security SummaryAI
CVE-2025-60081 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the PDF for Contact Form 7 WordPress plugin from add-ons.org, specifically the pdf-for-contact-form-7 component. This issue enables Object Injection and affects all versions from n/a through 6.5.0. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited remotely by an authenticated attacker with low privileges, such as a standard WordPress user, requiring low attack complexity and no user interaction. Successful exploitation allows high-impact consequences across confidentiality, integrity, and availability, potentially enabling object injection to execute arbitrary code or manipulate server-side data.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/pdf-for-contact-form-7/vulnerability/wordpress-pdf-for-contact-form-7-plugin-6-3-0-deserialization-of-untrusted-data-vulnerability?_s_id=cve provides details on the flaw, referencing version 6.3.0 within the affected range up to 6.5.0. Security practitioners should review the advisory for mitigation guidance, including any available patches or workarounds, and prioritize updating the plugin.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability in a WordPress plugin enables remote exploitation by low-privileged authenticated users for arbitrary code execution, directly mapping to exploitation of public-facing web applications.