CVE-2025-60224
Published: 22 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-60224 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WordPress plugin Subscribe to Download by wpshuffle, which allows Object Injection. The issue affects all versions of the plugin from its initial release through 2.0.9.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially leading to arbitrary object instantiation and related attacks such as remote code execution.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-php-object-injection-vulnerability?_s_id=cve provides details on the vulnerability in Subscribe to Download version 2.0.9 and guidance on mitigation.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a deserialization flaw in a public-facing WordPress plugin exploitable unauthenticated over the network, directly enabling exploitation of public-facing applications for potential RCE.