CVE-2025-60081
Published: 18 December 2025
Summary
CVE-2025-60081 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-60081 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the PDF for Contact Form 7 WordPress plugin from add-ons.org, specifically the pdf-for-contact-form-7 component. This issue enables Object Injection and affects all versions from n/a through 6.5.0. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited remotely by an authenticated attacker with low privileges, such as a standard WordPress user, requiring low attack complexity and no user interaction. Successful exploitation allows high-impact consequences across confidentiality, integrity, and availability, potentially enabling object injection to execute arbitrary code or manipulate server-side data.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/pdf-for-contact-form-7/vulnerability/wordpress-pdf-for-contact-form-7-plugin-6-3-0-deserialization-of-untrusted-data-vulnerability?_s_id=cve provides details on the flaw, referencing version 6.3.0 within the affected range up to 6.5.0. Security practitioners should review the advisory for mitigation guidance, including any available patches or workarounds, and prioritize updating the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204107
Vulnerability details
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability in a WordPress plugin enables remote exploitation by low-privileged authenticated users for arbitrary code execution, directly mapping to exploitation of public-facing web applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and timely patching of the deserialization flaw in the PDF for Contact Form 7 plugin.
Mandates validation of untrusted inputs to block malicious data deserialization leading to object injection in the plugin.
Controls and verifies user-installed software like the vulnerable WordPress plugin prior to deployment to prevent exploitation.