Cyber Posture

CVE-2025-60083

High

Published: 18 December 2025

Published
18 December 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents deserialization of untrusted data by validating inputs prior to processing, addressing the core CWE-502 vulnerability in the plugin.

prevent

Ensures timely identification, reporting, and patching of the specific deserialization flaw affecting PDF Invoice Builder for WooCommerce versions through 6.5.0.

prevent

Requires checking and restricting user-installed software like the vulnerable WordPress plugin prior to deployment, mitigating exploitation risk.

Security SummaryAI

CVE-2025-60083, published on 2025-12-18, is a Deserialization of Untrusted Data vulnerability (CWE-502) in the PDF Invoice Builder for WooCommerce WordPress plugin, with the slug pdf-for-woocommerce. The flaw enables Object Injection and affects the plugin from n/a through version 6.5.0 inclusive. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation involves providing untrusted data for deserialization, leading to Object Injection, which can compromise confidentiality, integrity, and availability at a high level within the affected scope.

The Patchstack advisory provides further details on the vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-builder-for-woocommerce-plugin-6-3-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Deserialization of Untrusted Data (CWE-502) in a public-facing WordPress plugin enables remote exploitation by low-privileged authenticated users, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References