Cyber Posture

CVE-2025-60210

Critical

Published: 22 October 2025

Published
22 October 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-60210 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the wpeverest Everest Forms - Frontend Listing WordPress plugin, specifically the everest-forms-frontend-listing component. This issue enables Object Injection and affects all versions from n/a through 1.0.5 inclusive.

With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by unauthenticated attackers remotely over the network. Exploitation requires low complexity and no user interaction, potentially allowing attackers to achieve high impacts on confidentiality, integrity, and availability through malicious object injection.

Patchstack has published details on this vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/everest-forms-frontend-listing/vulnerability/wordpress-everest-forms-frontend-listing-plugin-1-0-5-php-object-injection-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-502

Affected Products

wpeverest
everest forms frontend listing
≤ 1.0.5

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Deserialization of Untrusted Data (CWE-502) in a public-facing WordPress plugin enables unauthenticated remote object injection with high-impact RCE potential, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References