CVE-2025-60083
Published: 18 December 2025
Description
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents deserialization of untrusted data by validating inputs prior to processing, addressing the core CWE-502 vulnerability in the plugin.
Ensures timely identification, reporting, and patching of the specific deserialization flaw affecting PDF Invoice Builder for WooCommerce versions through 6.5.0.
Requires checking and restricting user-installed software like the vulnerable WordPress plugin prior to deployment, mitigating exploitation risk.
Security SummaryAI
CVE-2025-60083, published on 2025-12-18, is a Deserialization of Untrusted Data vulnerability (CWE-502) in the PDF Invoice Builder for WooCommerce WordPress plugin, with the slug pdf-for-woocommerce. The flaw enables Object Injection and affects the plugin from n/a through version 6.5.0 inclusive. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation involves providing untrusted data for deserialization, leading to Object Injection, which can compromise confidentiality, integrity, and availability at a high level within the affected scope.
The Patchstack advisory provides further details on the vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-builder-for-woocommerce-plugin-6-3-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of Untrusted Data (CWE-502) in a public-facing WordPress plugin enables remote exploitation by low-privileged authenticated users, directly mapping to exploitation of public-facing applications.