CVE-2025-60210

CriticalRCE

Published: 22 October 2025

Published

22 October 2025

Modified

20 January 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0010 26.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60210 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wpeverest Everest Forms Frontend Listing. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-60210 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the wpeverest Everest Forms - Frontend Listing WordPress plugin, specifically the everest-forms-frontend-listing component. This issue enables Object Injection and affects all versions from n/a through 1.0.5 inclusive.

With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by unauthenticated attackers remotely over the network. Exploitation requires low complexity and no user interaction, potentially allowing attackers to achieve high impacts on confidentiality, integrity, and availability through malicious object injection.

Patchstack has published details on this vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/everest-forms-frontend-listing/vulnerability/wordpress-everest-forms-frontend-listing-plugin-1-0-5-php-object-injection-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-35416

Vulnerability details

Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Deserialization of Untrusted Data (CWE-502) in a public-facing WordPress plugin enables unauthenticated remote object injection with high-impact RCE potential, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0