CVE-2025-60083
Published: 18 December 2025
Summary
CVE-2025-60083 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents deserialization of untrusted data by validating inputs prior to processing, addressing the core CWE-502 vulnerability in the plugin.
Ensures timely identification, reporting, and patching of the specific deserialization flaw affecting PDF Invoice Builder for WooCommerce versions through 6.5.0.
Requires checking and restricting user-installed software like the vulnerable WordPress plugin prior to deployment, mitigating exploitation risk.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of Untrusted Data (CWE-502) in a public-facing WordPress plugin enables remote exploitation by low-privileged authenticated users, directly mapping to exploitation of public-facing applications.
NVD Description
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
Deeper analysisAI
CVE-2025-60083, published on 2025-12-18, is a Deserialization of Untrusted Data vulnerability (CWE-502) in the PDF Invoice Builder for WooCommerce WordPress plugin, with the slug pdf-for-woocommerce. The flaw enables Object Injection and affects the plugin from n/a through version 6.5.0 inclusive. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation involves providing untrusted data for deserialization, leading to Object Injection, which can compromise confidentiality, integrity, and availability at a high level within the affected scope.
The Patchstack advisory provides further details on the vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoice-builder-for-woocommerce-plugin-6-3-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve.
Details
- CWE(s)