CVE-2025-60215
Published: 22 October 2025
Summary
CVE-2025-60215 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly prevents exploitation of the deserialization vulnerability by applying patches to affected Kriya theme versions up to 3.4.
Information input validation mitigates object injection by ensuring untrusted data is checked and sanitized before deserialization in the WordPress theme.
Vulnerability monitoring and scanning identifies the presence of CVE-2025-60215 in deployed Kriya theme instances for timely remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of untrusted data (PHP Object Injection) in a public-facing WordPress theme enables remote code execution from low-privileged authenticated access, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).
NVD Description
Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
Deeper analysisAI
CVE-2025-60215 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Kriya WordPress theme developed by designthemes. The flaw allows Object Injection and affects Kriya versions from n/a through 3.4 inclusive.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. A low-privileged authenticated attacker can exploit it over the network with low complexity and no user interaction required, achieving high impacts on confidentiality, integrity, and availability.
The Patchstack advisory provides further details on this WordPress Kriya theme vulnerability at https://patchstack.com/database/Wordpress/Theme/kriya/vulnerability/wordpress-kriya-theme-3-4-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)