---METADATA---
VENDOR: Themeton
PRODUCT: FinAg
AFFECTED_VERSIONS: n/a through 1.5.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The FinAg WordPress theme is susceptible to PHP object injection due to improper deserialization of untrusted data, which can lead to remote code execution.

Executive Summary:
The Themeton FinAg WordPress theme contains a critical deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-60237

Affected Software: Themeton FinAg

Affected Versions: n/a through 1.5.0

Vulnerability: This is a deserialization of untrusted data vulnerability (CWE-502) that allows for PHP object injection. It is exploitable by unauthenticated attackers, making it highly dangerous for internet-facing WordPress installations.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its potential for unauthenticated remote code execution. Successful exploitation can lead to total system compromise, including the theft of sensitive database information, modification of site content, and potential use of the server for secondary attacks.

Remediation Plan

Immediate Action: No patch is currently available; users should immediately deactivate the FinAg theme and switch to an alternative, supported theme to mitigate the threat.

Proactive Monitoring: Monitor server logs for unexpected PHP errors or suspicious serialized data patterns in request parameters.

Compensating Controls: Implement a WAF with virtual patching capabilities to inspect incoming requests for serialized PHP objects and block malicious payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an extremely high-priority concern for any environment running this theme.

Analyst Recommendation

Because this vulnerability is both critical and exploitable without authentication, it represents an immediate threat to infrastructure security. Deactivation of the theme is required immediately, and administrators must monitor the environment closely until the vendor provides a verified patch.

---METADATA---
VENDOR: Themeton
PRODUCT: Zuut
AFFECTED_VERSIONS: n/a through 1.4.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Zuut WordPress theme is susceptible to PHP object injection due to improper deserialization of untrusted data, which can lead to remote code execution.

Executive Summary:
The Themeton Zuut WordPress theme contains a critical deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-60233

Affected Software: Themeton Zuut

Affected Versions: n/a through 1.4.2

Vulnerability: This is a deserialization of untrusted data vulnerability (CWE-502) that allows for PHP object injection. The vulnerability is accessible to unauthenticated remote attackers.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to the availability, integrity, and confidentiality of the affected web application. Successful exploitation could grant an attacker full control over the web server, facilitating data breaches or the deployment of persistent backdoors.

Remediation Plan

Immediate Action: No patch is currently available; users should immediately deactivate the Zuut theme and transition to a supported alternative to protect the environment.

Proactive Monitoring: Monitor server logs for anomalous PHP activity or payloads containing serialized objects.

Compensating Controls: Utilize a robust WAF to filter out malicious web requests and prevent the delivery of serialized PHP payloads to the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the combination of high impact and low barrier to entry for attackers.

Analyst Recommendation

Given the lack of a vendor patch and the critical nature of unauthenticated remote code execution, immediate removal of the Zuut theme is strongly advised. Organizations must treat this as a high-urgency task to prevent potential compromise of their web infrastructure.

---METADATA---
VENDOR: axiomthemes
PRODUCT: White Rabbit
AFFECTED_VERSIONS: 0 through 1.5.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A deserialization of untrusted data vulnerability in the White Rabbit WordPress theme allows unauthenticated attackers to perform object injection.

Executive Summary:
A critical deserialization vulnerability in the White Rabbit theme allows unauthenticated remote attackers to perform object injection, leading to potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-60226

Affected Software: axiomthemes White Rabbit

Affected Versions: 0 through 1.5.2

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data, which can be exploited by an unauthenticated attacker to inject malicious PHP objects into the application.

Business Impact

Successful exploitation allows for object injection, which can be chained to achieve remote code execution, leading to total system compromise. With a CVSS score of 9.8, this represents the highest level of risk to the confidentiality, integrity, and availability of the affected WordPress site.

Remediation Plan

Immediate Action: As no official patch is currently available, immediately deactivate and remove the White Rabbit theme from your environment until a patched version is released by the vendor.

Proactive Monitoring: Review web server logs for unauthorized attempts to access or manipulate theme-specific files or serialized data streams.

Compensating Controls: Implement a robust Web Application Firewall (WAF) to block known serialization attack patterns; however, deactivation remains the only guaranteed mitigation at this time.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently critical due to the lack of required authentication.

Analyst Recommendation

Because no security update is currently available, the only effective way to mitigate this risk is to discontinue the use of the White Rabbit theme. Administrators should switch to an alternative theme immediately to protect their systems from potential exploitation.

Executive Summary:
A critical vulnerability has been identified in the AncoraThemes BugsPatrol software, assigned a severity score of 9.8 out of 10. This flaw allows an unauthenticated remote attacker to execute arbitrary code and take full control of the affected system by sending specially crafted data. Successful exploitation could lead to a complete system compromise, resulting in data theft, service disruption, or further infiltration of the network.

Vulnerability Details

CVE-ID: CVE-2025-60225

Affected Software: AncoraThemes BugsPatrol

Affected Versions: All versions up to and including 1.5.0

Vulnerability: The software is vulnerable to Deserialization of Untrusted Data. The application fails to properly validate user-supplied data before it is deserialized, a process used to convert a stream of data back into an object. An unauthenticated attacker can craft a malicious object and send it to the application, and upon deserialization, the malicious code embedded within the object is executed with the privileges of the application, leading to remote code execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high risk to the organization. Successful exploitation allows a remote attacker to gain complete control over the affected server, compromising its confidentiality, integrity, and availability. Potential consequences include the exfiltration of sensitive company or customer data, deployment of ransomware, disruption of critical services, and using the compromised system as a launchpad for further attacks against the internal network.

Remediation Plan

Immediate Action: Update all instances of AncoraThemes BugsPatrol to the latest version available from the vendor (a version greater than 1.5.0). After patching, it is crucial to monitor for any signs of exploitation that may have occurred prior to the update and to review system and application access logs for suspicious activity.

Proactive Monitoring: Security teams should actively monitor for indicators of compromise. This includes looking for unusual outbound network connections from servers running BugsPatrol, unexpected processes spawned by the application, and reviewing application logs for serialization errors or unusually formatted input data that could indicate an exploitation attempt.

Compensating Controls: If immediate patching is not feasible, organizations should implement compensating controls. Restrict network access to the affected application to only trusted IP addresses using a firewall. If the application is web-facing, deploy a Web Application Firewall (WAF) with rules designed to inspect and block serialized object payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Oct 22, 2025, there are no known public proof-of-concept exploits or observed in-the-wild attacks targeting this vulnerability. However, due to the critical severity (9.8) and the nature of the flaw (unauthenticated RCE), it is highly probable that threat actors and security researchers will develop exploits rapidly.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate action is required. We strongly recommend that all organizations using the affected versions of AncoraThemes BugsPatrol apply the vendor-supplied patches immediately to prevent potential system compromise. Although this CVE is not currently on the CISA KEV list, its high impact and potential for widespread exploitation make it a high-priority threat that should be addressed with the utmost urgency.

---METADATA---
VENDOR: wpshuffle
PRODUCT: Subscribe to Download
AFFECTED_VERSIONS: 0 through 2.0.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Subscribe to Download WordPress plugin is vulnerable to PHP Object Injection due to insecure deserialization of untrusted data.

Executive Summary:
The Subscribe to Download WordPress plugin contains a critical PHP Object Injection vulnerability that allows unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-60224

Affected Software: wpshuffle Subscribe to Download

Affected Versions: 0 through 2.0.9

Vulnerability: This vulnerability is a Deserialization of Untrusted Data (CWE-502) flaw within the plugin. The vulnerability is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector (AV:N/PR:N/UI:N).

Business Impact

Successful exploitation allows an attacker to perform arbitrary code execution, potentially leading to a full compromise of the WordPress site, data exfiltration, or total system takeover. Although the base CVSS score is 9.8, the nature of remote unauthenticated code execution poses a severe risk to organizational data integrity and availability.

Remediation Plan

Immediate Action: Update the Subscribe to Download plugin to version 2.1.0 or later immediately.

Proactive Monitoring: Review web server and WordPress application logs for suspicious serialized input strings or unexpected PHP object instantiation patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized objects in HTTP requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows for remote code execution without requiring user interaction or authentication.

Analyst Recommendation

This vulnerability presents a critical threat to the security of your WordPress environment. Administrators must prioritize updating to version 2.1.0 immediately to eliminate the risk of remote code execution.

---METADATA---
VENDOR: captivateaudio
PRODUCT: Captivate Sync
AFFECTED_VERSIONS: 0 through 3.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Captivate Sync WordPress plugin is vulnerable to PHP Object Injection, allowing unauthenticated attackers to trigger arbitrary code execution.

Executive Summary:
The Captivate Sync WordPress plugin is affected by a critical PHP Object Injection vulnerability that enables unauthorized remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-60221

Affected Software: captivateaudio Captivate Sync

Affected Versions: 0 through 3.0.3

Vulnerability: The plugin suffers from a Deserialization of Untrusted Data flaw (CWE-502). The vulnerability is accessible to unauthenticated attackers over the network, making it a high-priority target for automated exploitation.

Business Impact

An attacker successfully exploiting this flaw can gain full control over the application, leading to unauthorized access to sensitive information or complete site takeover. The high CVSS score reflects the ease of exploitation and the severe impact on system confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the Captivate Sync plugin to version 3.2.2 or later.

Proactive Monitoring: Monitor site traffic for unusual POST requests containing serialized PHP objects, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and block known malicious patterns associated with PHP object injection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's ability to be exploited remotely without authentication makes it highly attractive for threat actors.

Analyst Recommendation

Immediate remediation is required to protect the integrity of the affected WordPress site. Ensure the plugin is updated to version 3.2.2 immediately to mitigate the risk of remote code execution.

Executive Summary:
A critical vulnerability has been identified in the HaruTheme WooCommerce Designer Pro plugin, which could allow an unauthenticated attacker to take complete control of the affected web server. The flaw permits the upload of malicious files, such as a web shell, giving an attacker the ability to execute arbitrary code, steal sensitive data, and disrupt services. Due to the ease of exploitation and the maximum potential impact, this vulnerability is rated with the highest possible severity.

Vulnerability Details

CVE-ID: CVE-2025-60219

Affected Software: HaruTheme WooCommerce Designer Pro

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Unrestricted Upload of File with Dangerous Type. The application fails to properly validate the types of files being uploaded through its interface. An unauthenticated attacker can exploit this by crafting a request to upload a file with a dangerous extension (e.g., .php, .phtml) containing malicious code. Once the file, known as a web shell, is on the server, the attacker can access it via a direct URL to execute arbitrary commands with the permissions of the web server process, leading to a full system compromise.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10.0, representing the highest possible risk. Successful exploitation would grant an attacker complete control over the web server. The potential consequences include theft of sensitive data such as customer personal information and payment details, intellectual property loss, website defacement, and the use of the compromised server to launch further attacks against other systems. This can lead to severe financial loss, regulatory fines, and significant reputational damage.

Remediation Plan

Immediate Action: Immediately update the HaruTheme WooCommerce Designer Pro plugin to the latest version provided by the vendor to patch this vulnerability. After patching, it is crucial to review server access logs and file systems for any signs of compromise or suspicious files that may have been uploaded prior to the update.

Proactive Monitoring: Monitor web server logs for unusual POST requests to file upload endpoints, especially those containing files with executable extensions (e.g., .php, .aspx, .jsp). Implement file integrity monitoring on web directories to detect the creation of unauthorized files. Watch for unexpected outbound network traffic from the web server, which could indicate a web shell communicating with a command-and-control server.

Compensating Controls: If patching cannot be performed immediately, consider the following controls:

• Implement a Web Application Firewall (WAF) with rules to inspect file uploads and block malicious file types and exploit attempts.
• If the upload functionality in the plugin is not business-critical, disable it entirely.
• Harden the web server by configuring upload directories with no-execute permissions to prevent uploaded scripts from running.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Sep 26, 2025, there are no known public exploits for this vulnerability. However, given its critical severity (CVSS 10.0) and the simplicity of the vulnerability class, it is highly probable that threat actors will develop and deploy exploits rapidly. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate action is required. Organizations using the affected HaruTheme WooCommerce Designer Pro plugin must prioritize applying the security update without delay. Due to the high likelihood of exploitation, it is strongly recommended to assume the system is compromised if it was exposed to the internet before patching and to initiate incident response procedures to hunt for evidence of a web shell or other malicious activity.

---METADATA---
VENDOR: BoldThemes
PRODUCT: Addison
AFFECTED_VERSIONS: 0 through 1.4.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The BoldThemes Addison WordPress theme contains a PHP Object Injection vulnerability due to insecure deserialization, permitting unauthenticated remote code execution.

Executive Summary:
The BoldThemes Addison WordPress theme is subject to a critical PHP Object Injection vulnerability that allows for unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-60216

Affected Software: BoldThemes Addison

Affected Versions: 0 through 1.4.7

Vulnerability: This is a Deserialization of Untrusted Data (CWE-502) vulnerability. The flaw can be exploited by an unauthenticated attacker, as confirmed by the CVSS attack vector (AV:N/PR:N/UI:N).

Business Impact

Exploitation of this vulnerability could result in full site compromise, allowing attackers to execute commands, modify data, or exfiltrate sensitive information. The high CVSS score highlights the critical risk to organizational systems utilizing this theme.

Remediation Plan

Immediate Action: Update the Addison theme to version 1.4.8 or later immediately.

Proactive Monitoring: Inspect server logs for suspicious activity, particularly requests that involve complex or serialized data structures targeting the theme's components.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block unauthorized deserialization attempts directed at the WordPress theme.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this a significant risk for any public-facing installation.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for full system compromise, users of the BoldThemes Addison theme must update to version 1.4.8 without delay.

Executive Summary:
A critical vulnerability, identified as CVE-2025-60214, has been discovered in the BoldThemes Goldenblatt software. This flaw allows an unauthenticated remote attacker to execute arbitrary code on the server, potentially leading to a full system compromise. Successful exploitation could result in data theft, service disruption, or the deployment of malware such as ransomware.

Vulnerability Details

CVE-ID: CVE-2025-60214

Affected Software: BoldThemes Goldenblatt

Affected Versions: All versions up to and including 1.2.1

Vulnerability: The software is vulnerable to Deserialization of Untrusted Data. The application fails to properly sanitize user-supplied data before it is deserialized, which can lead to Object Injection. An unauthenticated remote attacker can craft a malicious serialized object and send it to the application, which, upon deserialization, can trigger a chain of code execution (known as a "gadget chain") already present in the application's libraries, resulting in arbitrary code execution with the permissions of the web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high risk to the organization. A successful attack could lead to a complete compromise of the affected server, allowing an attacker to steal sensitive corporate or customer data, install persistent backdoors, deploy ransomware, or use the compromised system as a pivot point to attack other internal network resources. The potential for reputational damage, financial loss, and operational disruption is significant.

Remediation Plan

Immediate Action: Immediately update the BoldThemes Goldenblatt software to the latest version available from the vendor, which addresses this vulnerability. After patching, monitor server logs for any signs of attempted or successful exploitation that may have occurred prior to the update. Review access logs for unusual or suspicious requests, particularly those with large, encoded payloads.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Look for anomalous activity in web server and application logs, such as unexpected error messages related to serialization or requests containing long, complex strings. Monitor for unexpected processes being spawned by the web server or unusual outbound network connections from the server.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block deserialization attack patterns. Restrict network access to the application, allowing connections only from trusted IP addresses. Egress filtering can also help prevent a compromised server from establishing outbound connections to an attacker's command-and-control infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Oct 22, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical CVSS score of 9.8 and the unauthenticated remote code execution nature of the flaw, it is highly probable that threat actors will develop and release exploit code in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that organizations prioritize the immediate patching of all affected BoldThemes Goldenblatt instances. This vulnerability represents a direct and severe threat of system compromise. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its characteristics make it a prime candidate for future inclusion. Organizations must act urgently to apply the vendor-provided updates or implement the recommended compensating controls to mitigate this risk.

Executive Summary:
A critical vulnerability has been discovered in Whitebox-Studio Scape, identified as CVE-2025-60213, with a CVSS score of 9.8. This flaw allows an unauthenticated remote attacker to execute arbitrary code on the affected system by sending a specially crafted data payload. Successful exploitation could lead to a complete compromise of the server, enabling data theft, service disruption, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2025-60213

Affected Software: Whitebox-Studio Scape

Affected Versions: All versions up to and including 1.5.13

Vulnerability: The vulnerability is a Deserialization of Untrusted Data flaw. The Scape application improperly handles user-supplied serialized data, failing to validate it before processing. An unauthenticated remote attacker can exploit this by sending a malicious serialized object to the application endpoint, which, when deserialized, triggers an object injection that leads to arbitrary code execution with the permissions of the application service account.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit could have a severe impact on the business, allowing an attacker to take full control of the affected server. Potential consequences include the theft of sensitive company or customer data, deployment of ransomware, disruption of critical business operations dependent on the application, and using the compromised system as a pivot point to attack other internal network resources. The risk of data breaches, financial loss, and significant reputational damage is extremely high.

Remediation Plan

Immediate Action: Update Whitebox-Studio Scape to the latest version available from the vendor (a version later than 1.5.13). After patching, monitor for any signs of post-exploitation activity and review historical access logs for indicators of compromise that may have occurred prior to remediation.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Security teams should look for unusual process execution originating from the Scape application, unexpected outbound network connections from the server, and application logs showing deserialization errors or warnings. Monitor for suspicious file modifications or the creation of unknown files in the application's directories.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Restrict network access to the Scape application, allowing connections only from trusted IP addresses.
• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block malicious serialized object payloads.
• Implement strict egress filtering to prevent the server from making outbound connections to unauthorized external hosts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of October 22, 2025, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there are no known public exploits available. However, vulnerabilities involving deserialization are well understood and often lead to reliable exploit development. Given the critical CVSS score, organizations should assume that threat actors are actively working to develop an exploit.

Analyst Recommendation

Due to the critical severity and the high probability of future exploitation leading to remote code execution, it is imperative that organizations prioritize patching this vulnerability immediately. All instances of Whitebox-Studio Scape version 1.5.13 and earlier should be updated without delay. If patching cannot be performed immediately, apply the recommended compensating controls and actively monitor systems for any signs of compromise.

Executive Summary:
A critical vulnerability has been identified in the wpeverest Everest Forms plugin for WordPress, specifically related to the Frontend Listing add-on. This flaw, rated 9.8 out of 10, allows an unauthenticated attacker to inject malicious code and potentially gain complete control over the affected website. Successful exploitation could lead to data theft, website defacement, or the server being used for further malicious activities.

Vulnerability Details

CVE-ID: CVE-2025-60210

Affected Software: wpeverest Everest Forms and its add-on, Everest Forms - Frontend Listing

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Deserialization of Untrusted Data, which leads to PHP Object Injection. The application improperly handles user-supplied data when processing form listings. An unauthenticated remote attacker can send a specially crafted serialized PHP object to the application. When the application deserializes this malicious data, the object is created in memory, and its code can be executed, resulting in arbitrary code execution on the web server with the privileges of the web service account.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit could lead to a full compromise of the web server hosting the WordPress site. The potential business impacts are severe and include theft of sensitive data (such as customer information, user credentials, and payment details), complete website defacement, disruption of business operations, and significant reputational damage. The compromised server could also be leveraged to attack other internal systems or to distribute malware, creating further legal and financial liabilities for the organization.

Remediation Plan

Immediate Action: Immediately update the wpeverest Everest Forms plugin and all associated add-ons to the latest version provided by the vendor to patch this vulnerability. After applying the update, it is critical to review web server and application access logs for any suspicious activity or exploitation attempts that may have occurred prior to patching.

Proactive Monitoring: Implement monitoring to detect potential exploitation attempts. Security teams should look for unusual POST requests in web server logs, particularly those containing long, base64-encoded, or complex strings indicative of serialized PHP objects. Monitor the file system for the creation of unexpected files (e.g., PHP webshells) in web-accessible directories, and watch for anomalous system behavior such as unexpected outbound network connections or high CPU utilization from the web server process.

Compensating Controls: If immediate patching is not feasible, consider the following controls to mitigate risk:

• Web Application Firewall (WAF): Deploy or update a WAF with rules specifically designed to detect and block PHP object injection and deserialization attacks.
• Disable Plugin: If the functionality is not business-critical, temporarily disable the "Everest Forms" and "Everest Forms - Frontend Listing" plugins until patching can be completed.
• Access Control: Restrict access to the website and any form submission endpoints to trusted IP ranges, if applicable.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of October 22, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the critical CVSS score of 9.8 and the low complexity of exploitation, it is highly probable that a functional exploit will be developed by security researchers and threat actors in the near future. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but organizations should monitor its status closely.

Analyst Recommendation

Due to the critical severity (CVSS 9.8) of this vulnerability, which allows for unauthenticated remote code execution, we recommend immediate and urgent action. All instances of the wpeverest Everest Forms plugin and its add-ons must be updated to a patched version without delay. Although this vulnerability is not yet on the CISA KEV list, its potential impact warrants treating it with the highest priority. If patching cannot be performed immediately, the plugin should be disabled to prevent compromise of the web server.

Executive Summary:
A high-severity vulnerability, identified as CVE-2025-60209, has been discovered in the CRM Perks Connector for Gravity Forms and Google Sheets WordPress plugin. This flaw allows an unauthenticated attacker to inject malicious code and potentially take full control of the affected website. Organizations using this plugin are at significant risk of data breaches, website defacement, and further network compromise.

Vulnerability Details

CVE-ID: CVE-2025-60209

Affected Software: Google Multiple Products (Specifically, the "CRM Perks Connector for Gravity Forms and Google Sheets" WordPress plugin, which integrates with Google Sheets)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Deserialization of Untrusted Data flaw within the WordPress plugin. An unauthenticated attacker can send a specially crafted serialized PHP object to an endpoint handled by the plugin. The application insecurely deserializes this data without proper validation, which can instantiate a malicious object in memory. By leveraging existing code within the WordPress environment (known as a "POP chain"), an attacker can trigger a chain of events leading to arbitrary code execution, file manipulation, or other unauthorized actions on the web server.

Business Impact

This is a high-severity vulnerability with a CVSS score of 8.2, posing a significant risk to the business. Successful exploitation could lead to a complete compromise of the web server hosting the affected WordPress site. The potential consequences include theft of sensitive data from the website's database (such as customer information or form submissions), service disruption, website defacement, and the use of the compromised server as a launch point for further attacks against the internal network, leading to severe financial and reputational damage.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. All systems running the "CRM Perks Connector for Gravity Forms and Google Sheets" plugin should be identified and patched as a top priority. Following the update, administrators should monitor for any signs of exploitation attempts by reviewing web server and application access logs.

Proactive Monitoring: Security teams should monitor web server access logs for unusual POST requests, particularly those containing long, encoded strings which may indicate a serialized object. Monitor PHP and application error logs for deserialization-related errors. File Integrity Monitoring (FIM) should be used to detect unauthorized changes to plugin files, and network traffic should be monitored for any suspicious outbound connections from the web server.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block PHP object injection attempts. As a temporary measure, consider disabling the affected plugin until it can be safely updated. Restricting access to pages utilizing the plugin to trusted IP addresses can also reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of October 22, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, deserialization vulnerabilities are well-understood, and the technical details provided in an advisory are often sufficient for skilled attackers to develop a functional exploit.

Analyst Recommendation

Given the high CVSS score of 8.2 and the potential for unauthenticated remote code execution, this vulnerability represents a critical risk. Although it is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a likely target for future exploitation. We strongly recommend that all organizations using the affected plugin prioritize applying the vendor-supplied patch immediately to prevent potential system compromise.

Executive Summary:
A high-severity vulnerability has been identified in the WooCommerce Store Toolkit plugin, which allows an attacker to access and potentially execute sensitive files on the web server. Successful exploitation could lead to the exposure of confidential data, such as database credentials, or a complete compromise of the affected website. Organizations are urged to apply the vendor-provided security patch immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-60204

Affected Software: Josh Kohlbach WooCommerce Store Toolkit

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw. It exists because the application uses user-supplied input to construct a file path for a PHP include or require statement without proper validation. An attacker can exploit this by manipulating the input with directory traversal sequences (e.g., ../) to force the application to include and execute arbitrary PHP files already on the server or to read the contents of sensitive system files, such as wp-config.php or /etc/passwd.

Business Impact

This vulnerability is rated as high severity with a CVSS score of 7.5. Exploitation could have a significant business impact, including the theft of sensitive data like customer information and database credentials, leading to a major data breach. An attacker could also leverage this flaw to gain further access, deface the website, or execute malicious code, potentially resulting in a full server compromise. The consequences include financial loss, reputational damage, and potential regulatory penalties.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor, Josh Kohlbach, immediately. This is the most effective way to eliminate the vulnerability. After patching, review web server access logs and system logs for any signs of exploitation that may have occurred prior to remediation.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests containing directory traversal patterns (../), null bytes (%00), and attempts to access common sensitive files (e.g., wp-config.php, /etc/shadow, .env). Monitor for unexpected file modifications on the server or the creation of new, unauthorized files in web-accessible directories.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attacks. Additionally, harden server file permissions to ensure the web server process has read/write access only to the directories it absolutely requires, limiting the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, LFI vulnerabilities are a well-understood and commonly targeted class of flaw, and proof-of-concept exploits are often developed quickly by security researchers and threat actors.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the potential for complete system compromise, organizations must treat this vulnerability with high priority. The recommended course of action is to apply the vendor-supplied patch across all affected systems without delay. Although this CVE is not currently on the CISA KEV list, the ease of exploitation for LFI vulnerabilities warrants immediate attention to prevent future compromise. Security teams should confirm the patch has been successfully deployed and continue to monitor for any related indicators of attack.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from the Josh Kohlbach Store, specifically affecting the woocommerce-exporter plugin. This flaw allows an attacker to access sensitive files on the web server, potentially leading to the theft of confidential data such as database credentials, customer information, and system configuration files. Immediate application of vendor-supplied security updates is required to mitigate the risk of server compromise and data breach.

Vulnerability Details

CVE-ID: CVE-2025-60203

Affected Software: Josh Kohlbach Store Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw within the woocommerce-exporter plugin. It stems from an improper control of filenames used in PHP's include or require statements. An unauthenticated remote attacker can manipulate an input parameter to trick the application into including and executing arbitrary files from the local server's file system. By supplying specially crafted file paths, such as those using directory traversal sequences (../), an attacker could read sensitive files like wp-config.php (containing database credentials), /etc/passwd, or other application and system files.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to significant business consequences, including the exposure of sensitive corporate and customer data, intellectual property theft, and a complete compromise of the web application. The theft of database credentials could grant an attacker full access to the underlying database, resulting in a major data breach. Such an incident could cause severe reputational damage, financial loss, and potential regulatory fines.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected systems immediately. After patching, it is crucial to review web server access logs and application logs for any signs of past or ongoing exploitation attempts.

Proactive Monitoring: Security teams should actively monitor web server logs for requests containing common LFI patterns, such as directory traversal characters (../, ..%2f), and attempts to access sensitive system files (e.g., wp-config.php, /etc/passwd). Implement file integrity monitoring to detect unauthorized changes to critical application files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block LFI and directory traversal attack patterns. Additionally, harden the server's PHP configuration by ensuring allow_url_fopen and allow_url_include are disabled and by using the open_basedir directive to restrict the file paths PHP can access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the nature of LFI vulnerabilities, proof-of-concept exploits are often developed quickly by security researchers and threat actors.

Analyst Recommendation
Given the high severity (CVSS 7.5) and the potential for complete data compromise, we strongly recommend that organizations prioritize the immediate deployment of the vendor-provided patches. Although this CVE is not currently listed on the CISA KEV list, its impact makes it a highly attractive target for attackers. Organizations should treat this as a critical vulnerability and proceed with the remediation plan without delay to prevent potential compromise.

Executive Summary:
A high-severity vulnerability has been identified in the InHype WordPress Theme, which could allow an attacker to read sensitive files on the web server. This flaw, known as Local File Inclusion, can be exploited remotely without authentication, potentially exposing confidential data such as database credentials, system files, and application source code. Successful exploitation could lead to a full server compromise, data breach, and significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-60199

Affected Software: dedalx InHype - Blog & Magazine WordPress Theme

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw. It exists because the theme's code improperly handles user-supplied input when including files using PHP's include() or require() functions. An unauthenticated attacker can manipulate a URL parameter to inject directory traversal sequences (e.g., ../../..) and force the application to include and display the contents of arbitrary files from the server's local file system. This could allow the attacker to access sensitive information, such as the wp-config.php file containing database credentials, or system files like /etc/passwd.

Business Impact

This is a high-severity vulnerability with a CVSS score of 8.2. Exploitation could have a severe impact on the business, leading to a significant data breach through the exposure of sensitive files and credentials. An attacker could leverage this access to gain further control over the web server, deface the website, install malware, or use the compromised server to launch attacks against other systems. The potential consequences include reputational damage, loss of customer trust, regulatory penalties for data exposure, and significant costs associated with incident response and system recovery.

Remediation Plan

Immediate Action: The primary remediation is to update the 'InHype - Blog & Magazine WordPress Theme' to the latest version provided by the vendor, which contains a patch for this vulnerability. If the theme is not essential or no longer in use, it should be deactivated and completely removed from the WordPress installation to eliminate the attack surface.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal patterns (e.g., ../, %2e%2e/) or attempts to access common sensitive files (wp-config.php, /etc/passwd, .env) within URL parameters. Monitor for any unusual file modifications or outbound network connections from the web server, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attacks. Additionally, ensure PHP is hardened by disabling allow_url_include in the php.ini configuration and that the web server process runs with the principle of least privilege, restricting its ability to read files outside of the web root directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, LFI is a well-understood vulnerability class, and security researchers or threat actors could develop a functional exploit with minimal effort. Organizations should operate under the assumption that an exploit could become available at any time.

Analyst Recommendation

Given the high severity (CVSS 8.2) of this vulnerability and the potential for complete server compromise, immediate action is required. It is strongly recommended that all organizations using the 'InHype - Blog & Magazine WordPress Theme' apply the vendor-supplied patch or remove the theme without delay. Although this CVE is not currently on the CISA KEV catalog, its high potential for impact warrants urgent prioritization in your patch management cycle to prevent data exposure and system compromise.

Executive Summary:
A high-severity vulnerability has been identified in the Saxon WordPress theme, which allows for Local File Inclusion (LFI). An unauthenticated attacker could exploit this flaw to read sensitive files from the underlying server, such as configuration files containing database credentials. Successful exploitation could lead to a significant data breach and potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-60198

Affected Software: dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability, classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), exists within the Saxon WordPress theme. The application fails to properly sanitize user-supplied input that is used as a path in a PHP include or require statement. An unauthenticated remote attacker can manipulate this input to include arbitrary local files on the server. By crafting a malicious request containing path traversal sequences (e.g., ../), an attacker can force the application to read and display the contents of sensitive files, such as wp-config.php or /etc/passwd, within the web server's response.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Exploitation could have a severe impact on the business, leading to a major data breach. If an attacker successfully reads the wp-config.php file, they will gain access to database credentials, which could be used to access, modify, or exfiltrate all data stored in the website's database. This exposure of sensitive customer data or proprietary information can result in significant financial loss, regulatory fines, and irreparable damage to the organization's reputation and customer trust.

Remediation Plan

Immediate Action:

• Identify all WordPress instances using the "Saxon" theme and immediately update it to the latest version provided by the vendor (dedalx).
• If the Saxon theme is installed but not active or no longer needed on any WordPress site, it should be completely removed to eliminate the attack surface.

Proactive Monitoring:

• Review web server access logs for requests containing path traversal characters (e.g., ../, ..\/) or requests attempting to access common sensitive files (e.g., wp-config.php, /etc/passwd, .env).
• Implement File Integrity Monitoring (FIM) on critical server files to detect any unauthorized access or changes.
• Monitor for unusual outbound network traffic from the web server, which could indicate a post-exploitation data exfiltration attempt.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block Local File Inclusion and path traversal attack patterns.
• Harden the underlying server's PHP configuration by using the open_basedir directive to restrict the file paths that PHP is allowed to access.
• Ensure the web server process runs under a low-privileged user account to limit the scope of files an attacker can read if the vulnerability is exploited.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, LFI vulnerabilities in popular WordPress components are highly sought after by threat actors and are often quickly weaponized once technical details become public.

Analyst Recommendation

Given the high CVSS score of 8.2 and the potential for complete database compromise, this vulnerability poses a significant risk to the organization. It is strongly recommended that all system administrators immediately identify assets running the vulnerable Saxon WordPress theme and apply the necessary updates without delay. Although this CVE is not currently listed on the CISA KEV catalog, its severity and the ubiquity of WordPress warrant immediate attention. Prioritize patching on production and internet-facing systems, and consider removing the theme entirely if it is not essential to business operations.

Executive Summary:
A high-severity vulnerability has been discovered in multiple products from the vendor Improper. This flaw, identified as CVE-2025-60197, could allow an unauthenticated remote attacker to read sensitive files on the server, potentially exposing confidential data like system credentials, configuration files, and user information. Immediate application of vendor-provided security updates is necessary to mitigate the risk of data compromise and further system intrusion.

Vulnerability Details

CVE-ID: CVE-2025-60197

Affected Software: Improper Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from the improper sanitization of user-supplied input used in PHP include or require statements. An unauthenticated remote attacker can manipulate a file path parameter in a request to the affected application. By using directory traversal sequences (e.g., ../), the attacker can trick the application into including and displaying the contents of arbitrary files from the server's local file system that are readable by the web server process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Successful exploitation could lead to significant data breaches by exposing sensitive information stored on the server, including application source code, database credentials, API keys, and system configuration files like /etc/passwd. The theft of such information could result in regulatory penalties, financial loss, reputational damage, and could serve as a foothold for attackers to escalate privileges and conduct more severe attacks against the organization's internal network.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. System administrators should prioritize the deployment of the patches released by the vendor across all affected systems to eliminate the vulnerability. After patching, review web server access logs for any evidence of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor web server logs for HTTP requests containing directory traversal patterns (e.g., ../, %2e%2e/) in URL parameters. Implement alerts for unusual file access attempts by the web server's user account. Network monitoring should be in place to detect any anomalous outbound traffic from affected servers, which could indicate data exfiltration.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block LFI and directory traversal attack patterns.
• Enforce the principle of least privilege by hardening file system permissions to ensure the web server process can only access files within the web root directory.
• If possible, disable dangerous PHP functions and ensure secure configurations are in place.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, this vulnerability has been recently disclosed. There are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. However, LFI vulnerabilities are well-understood and relatively easy to exploit, so it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the High severity (CVSS 8.2) of this vulnerability and its potential to cause a significant data breach, we recommend immediate and decisive action. Organizations must prioritize the application of the vendor-supplied security patches to all affected systems. Although this vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, its critical nature warrants treatment as a high-priority threat. Proactive monitoring and the implementation of compensating controls should be pursued to provide a defense-in-depth security posture.

---METADATA---
VENDOR: Vito Peleg
PRODUCT: Atarim (atarim-visual-collaboration)
AFFECTED_VERSIONS: n/a through <= 4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect privilege assignment vulnerability in the Atarim visual collaboration plugin allows unauthorized users to escalate their privileges.

Executive Summary:
The Vito Peleg Atarim plugin is affected by a critical privilege escalation vulnerability that allows unauthorized users to gain elevated administrative access.

Vulnerability Details

CVE-ID: CVE-2025-60195

Affected Software: Vito Peleg Atarim

Affected Versions: n/a through <= 4.2

Vulnerability: The plugin incorrectly handles user privilege assignments, which can be leveraged by authenticated users to escalate their access level. This flaw compromises the integrity of the WordPress user management system.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to organizational security. An attacker who successfully escalates their privileges can modify system settings, access sensitive user data, or gain total administrative control over the platform, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Atarim visual collaboration plugin to the latest available version to address the privilege assignment logic.

Proactive Monitoring: Audit user account changes and administrative logs for unauthorized privilege modifications or suspicious activity by standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) and limit administrative privileges to only those users who strictly require them until the patch is applied.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Nov 6, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score, immediate patching is required to prevent unauthorized privilege escalation. Security teams should ensure that all instances of the Atarim plugin are updated to a version that includes the necessary security fixes.

Executive Summary:
A high-severity vulnerability has been identified in the Premmerce Product Search for WooCommerce plugin. This flaw, known as a Local File Inclusion, could allow an unauthenticated attacker to read sensitive files from the underlying web server, such as configuration files containing database credentials. Successful exploitation could lead to a significant data breach and further system compromise.

Vulnerability Details

CVE-ID: CVE-2025-60194

Affected Software: Premmerce Product Search for WooCommerce

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from an improper control of filenames used in PHP's include or require statements. An attacker can exploit this by crafting a special request that manipulates an input parameter to specify a file path on the server. This forces the application to include and potentially execute or display the contents of arbitrary local files, such as wp-config.php (containing database credentials) or system files like /etc/passwd.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have a severe business impact, primarily affecting data confidentiality and system integrity. An attacker could exfiltrate sensitive information, including database credentials, API keys, and other application secrets stored on the server. This could lead to a full database compromise, unauthorized access to customer data, reputational damage, regulatory fines, and provide a foothold for attackers to escalate their privileges and move laterally across the network.

Remediation Plan

Immediate Action: Identify all websites using the vulnerable "Premmerce Product Search for WooCommerce" plugin and apply the security updates provided by the vendor immediately. After patching, review web server access logs for any signs of exploitation that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor web server logs for suspicious requests targeting the vulnerable plugin. Look for log entries containing path traversal sequences (e.g., ../, ..\/) or attempts to access common sensitive files like wp-config.php, .env, or /etc/passwd. Monitor for unusual PHP errors in logs, which could indicate failed inclusion attempts.

Compensating Controls: If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) with rules designed to detect and block LFI and path traversal attack patterns. As a temporary measure, disabling the vulnerable plugin can also remove the immediate attack vector until a patch can be applied. Restricting the web server's file permissions can also limit the impact by preventing it from accessing sensitive files outside of its root directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities of this type in popular WordPress/WooCommerce plugins are frequently targeted by threat actors shortly after disclosure. Organizations should assume that exploit code will become available and act accordingly.

Analyst Recommendation
Given the high severity (CVSS 7.5) and the potential for sensitive data exposure, it is critical that organizations prioritize the remediation of this vulnerability. We strongly recommend immediately applying the vendor-supplied security patch to all instances of the affected plugin. Although this vulnerability is not currently listed on the CISA KEV catalog, its impact is significant, and proactive patching is the most effective defense against potential future exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple Premmerce products, specifically the Premmerce Wholesale Pricing for WooCommerce plugin. This flaw allows an attacker to trick the application into accessing and displaying the contents of sensitive files on the server. Successful exploitation could lead to the exposure of confidential data, such as configuration details and user credentials, potentially enabling further unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2025-60192

Affected Software: Premmerce Premmerce Wholesale Pricing for WooCommerce

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from an improper control of a filename used in a PHP include() or require() statement. The application fails to properly sanitize user-supplied input that is used to construct a file path. An unauthenticated remote attacker can exploit this by manipulating input parameters with directory traversal sequences (e.g., ../) to navigate the server's file system and include arbitrary files. This could allow the attacker to read sensitive files like wp-config.php (containing database credentials), /etc/passwd, or other system and application files, leading to significant information disclosure.

Business Impact

This vulnerability is rated as high severity with a CVSS score of 7.5. Exploitation could have a significant negative impact on the business by leading to the compromise of sensitive data, including customer information, intellectual property, and system credentials. This data breach could result in direct financial loss, severe reputational damage, and potential regulatory penalties for non-compliance with data protection standards. If the attacker can leverage this LFI to achieve code execution, they could gain complete control over the web server, disrupting business operations and enabling further attacks against the internal network.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by the vendor to all affected systems immediately. Before deployment to production, patches should be tested in a staging environment to ensure compatibility and stability. Following the update, it is crucial to monitor for any signs of exploitation attempts and to conduct a thorough review of historical access logs for indicators of compromise.

Proactive Monitoring: Security teams should actively monitor web server access logs for requests containing directory traversal patterns (e.g., ../, ..%2f, ..\) in URL parameters associated with the affected plugin. Monitor for unusual read attempts on sensitive system files by the web server process. Implementing file integrity monitoring can help detect unauthorized changes to critical application files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attacks. Additionally, harden the web server's file permissions to restrict the web server user's access to only necessary files and directories, limiting the impact of a potential breach. Ensure PHP configurations are hardened, for example, by disabling allow_url_include.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities are well-understood and relatively easy to exploit. It is highly probable that proof-of-concept (PoC) exploit code will be developed and released by security researchers or threat actors in the near future.

Analyst Recommendation

Given the high CVSS score of 7.5 and the potential for sensitive data exposure and server compromise, this vulnerability presents a significant risk. We strongly recommend that organizations identify all instances of the affected Premmerce software and prioritize the immediate application of vendor-supplied security patches. Although this CVE is not currently listed on the CISA KEV catalog, its severity warrants urgent attention. Proactive monitoring for exploitation attempts should be implemented concurrently to detect and respond to any malicious activity targeting this flaw.

Executive Summary:
A high-severity vulnerability has been identified in multiple Premmerce products, specifically affecting the Premmerce Wishlist for WooCommerce plugin. This flaw, a Local File Inclusion, could allow an unauthenticated attacker to read sensitive files from the underlying server, such as configuration files containing database credentials. Successful exploitation could lead to a significant data breach and further compromise of the web application and server.

Vulnerability Details

CVE-ID: CVE-2025-60191

Affected Software: Premmerce Premmerce Multiple Products, including Premmerce Wishlist for WooCommerce.

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is a Local File Inclusion (LFI) resulting from an improper control of a filename used in a PHP include or require statement. An attacker can exploit this by sending a specially crafted request to the web server that includes path traversal sequences (e.g., ../) or absolute file paths. The vulnerable application code fails to properly sanitize this input, causing it to include and potentially display the contents of arbitrary files from the server's local file system that are readable by the web server process, such as wp-config.php or /etc/passwd.

Business Impact

This is a high-severity vulnerability with a CVSS score of 7.5. Exploitation can lead to the disclosure of highly sensitive information, including database credentials, application source code, and system configuration files. This information leak can serve as a stepping stone for more severe attacks, such as complete database compromise, administrative account takeover, or full system control. The potential business impact includes significant data breaches, reputational damage, loss of customer trust, and potential regulatory fines.

Remediation Plan

Immediate Action: Apply the security updates provided by Premmerce to all affected products immediately. Patches can typically be applied through the WordPress administration dashboard. After patching, it is critical to review web server access logs for any signs of exploitation attempts that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor web server access logs for requests targeting the vulnerable plugin's endpoints. Look for suspicious patterns in request parameters, such as directory traversal characters (../, ..\/), absolute file paths (e.g., /etc/passwd), or PHP wrappers like php://filter. Implement alerts within a Security Information and Event Management (SIEM) or a Web Application Firewall (WAF) to detect and block these malicious patterns.

Compensating Controls: If immediate patching is not feasible, consider the following compensating controls:

• Deploy a WAF with rulesets specifically designed to detect and block LFI and path traversal attacks.
• Temporarily disable the vulnerable Premmerce plugin until a patch can be applied and tested.
• Harden the web server's file permissions to ensure the web server process has read access only to the files it absolutely requires.
• Review and harden the PHP configuration (e.g., open_basedir) to restrict the locations from which PHP can access files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities in popular WordPress plugins are frequently and rapidly weaponized by threat actors once a proof-of-concept becomes available. Organizations should assume that exploitation is imminent.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and its potential for exposing critical server data, we strongly recommend that organizations apply the vendor-supplied patches as an immediate priority. Although this CVE is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its impact on widely-used WooCommerce environments makes it a significant risk. A proactive patching and monitoring stance is essential to prevent a potential compromise.

Executive Summary:
A high-severity vulnerability has been identified in the Hinnerk Altenburg Immocaster WordPress plugin, which could allow an unauthenticated attacker to read sensitive files from the underlying server. Successful exploitation could lead to the exposure of confidential data, such as website configuration details and database credentials, potentially enabling further system compromise. Organizations using the affected plugin are urged to apply the recommended updates immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-60190

Affected Software: Hinnerk Altenburg Immocaster WordPress Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw within the Immocaster plugin. It arises from the improper sanitization of user-supplied input that is used to construct a file path for a PHP include or require statement. An attacker can exploit this by crafting a malicious request that manipulates the input to traverse the file system and specify an arbitrary file on the server. The server would then process and potentially display the contents of the requested file, such as wp-config.php (containing database credentials) or system files like /etc/passwd.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Exploitation can lead to significant business impact, including the breach of sensitive data and intellectual property. An attacker could leverage the exposed information, particularly database credentials, to gain unauthorized access to the website's database, steal customer information, or deface the website. Such an incident could result in severe reputational damage, loss of customer trust, and potential regulatory fines for data breaches.

Remediation Plan

Immediate Action: The primary remediation is to update the affected "Immocaster" WordPress plugin to the latest patched version provided by the vendor. If the plugin is not critical to business operations, a secondary option is to disable and remove it entirely from the WordPress installation to eliminate the attack surface.

Proactive Monitoring: Monitor web server access logs for suspicious requests targeting the Immocaster plugin. Look for patterns indicative of LFI attacks, such as directory traversal sequences (../, ..\/) and requests for common sensitive files (wp-config.php, /etc/passwd, .env) within URL parameters. Use a file integrity monitoring (FIM) system to alert on unauthorized access to or changes in critical configuration files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI and directory traversal attack patterns. Additionally, ensure PHP is configured securely by hardening the php.ini file (e.g., disabling allow_url_include) and enforce strict file system permissions to limit the files the web server process is authorized to read.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 6, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, Local File Inclusion vulnerabilities in popular CMS plugins are highly sought after by threat actors and are often quickly weaponized. Automated scanning for this flaw is expected to begin once a proof-of-concept exploit is made public.

Analyst Recommendation

Given the high severity score (CVSS 8.1) and the critical nature of the data that can be exposed, we strongly recommend that organizations identify all instances of the Immocaster WordPress plugin and apply the vendor-supplied patch immediately. While this vulnerability is not currently on the CISA KEV list, its potential for data exfiltration presents a significant risk. Prioritize this patch to prevent potential data breaches and subsequent system compromise.

---METADATA---
VENDOR: CRM Perks
PRODUCT: WP Gravity Forms Salesforce
AFFECTED_VERSIONS: n/a through 1.5.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The CRM Perks WP Gravity Forms Salesforce plugin is susceptible to deserialization of untrusted data, which can lead to arbitrary object injection.

Executive Summary:
A critical object injection vulnerability in the WP Gravity Forms Salesforce plugin enables remote code execution or unauthorized system access via deserialization of untrusted data.

Vulnerability Details

CVE-ID: CVE-2025-60180

Affected Software: CRM Perks WP Gravity Forms Salesforce

Affected Versions: n/a through 1.5.1

Vulnerability: The plugin fails to safely handle deserialization of user-supplied data. This allows an attacker to inject malicious objects into the application, which can be leveraged for further exploitation.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to the integrity and availability of the WordPress site. Successful exploitation could lead to full system compromise, allowing attackers to execute arbitrary code and gain access to sensitive Salesforce integration data.

Remediation Plan

Immediate Action: Update the WP Gravity Forms Salesforce plugin to the most recent version provided by CRM Perks to resolve the deserialization flaw.

Proactive Monitoring: Monitor server logs for unusual serialized data patterns or anomalous traffic originating from the plugin's endpoints.

Compensating Controls: Utilize a WAF to inspect incoming traffic for known deserialization attack payloads, providing a temporary layer of protection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 18, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of object injection vulnerabilities, organizations must treat this update with the highest urgency. Ensure the plugin is patched immediately to prevent remote exploitation of the WordPress environment.

---METADATA---
VENDOR: CRM Perks
PRODUCT: WP Gravity Forms HubSpot
AFFECTED_VERSIONS: n/a through 1.2.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The CRM Perks WP Gravity Forms HubSpot plugin contains a deserialization vulnerability that permits the injection of malicious objects.

Executive Summary:
A critical object injection flaw in the WP Gravity Forms HubSpot plugin creates a high risk of remote code execution and unauthorized data access due to unsafe deserialization.

Vulnerability Details

CVE-ID: CVE-2025-60178

Affected Software: CRM Perks WP Gravity Forms HubSpot

Affected Versions: n/a through 1.2.6

Vulnerability: The vulnerability involves the unsafe deserialization of untrusted input within the plugin. An attacker can use this flaw to inject arbitrary objects, potentially leading to critical impacts on the host system.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, which could result in complete compromise of the WordPress site. Impacted businesses face significant risks, including unauthorized access to HubSpot CRM data and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the WP Gravity Forms HubSpot plugin to the latest version released by CRM Perks to mitigate the object injection risk.

Proactive Monitoring: Audit application logs for suspicious activity and monitor for unexpected changes in system configuration or database entries.

Compensating Controls: Implement a WAF to filter malicious payloads and block unauthorized access attempts specifically targeting the plugin's data processing functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 18, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is required to secure the application against this critical vulnerability. Administrators should verify that the patch is applied and perform a security review of the environment following the update.

Executive Summary:
A critical vulnerability has been identified in the WP Gravity Forms Constant Contact Plugin for WordPress, which could allow an unauthenticated attacker to take complete control of an affected website. The flaw, a result of deserializing untrusted data, can be exploited to execute arbitrary code, leading to potential data theft, website defacement, or further network compromise. Immediate patching is required to mitigate this high-risk threat.

Vulnerability Details

CVE-ID: CVE-2025-60174

Affected Software: CRM Perks WP Gravity Forms Constant Contact Plugin (gf-constant-contact)

Affected Versions: All versions up to and including 1.1.2

Vulnerability: The vulnerability is an Insecure Deserialization flaw. The plugin improperly handles serialized data submitted by a user. An attacker can craft a malicious serialized object and send it to the application; when the plugin deserializes this data, it can trigger a "property-oriented programming" (POP) chain, leading to the execution of arbitrary code on the underlying web server with the privileges of the web service account. This type of attack typically does not require authentication.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation could lead to a complete compromise of the web server hosting the WordPress site. The potential consequences include theft of sensitive data submitted through forms (such as PII and customer information), unauthorized modification or deletion of website content, and using the compromised server as a launch point for further attacks against the internal network. This poses a severe risk to data confidentiality, integrity, and availability, potentially resulting in significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Immediately update the WP Gravity Forms Constant Contact Plugin to the latest version available (a version greater than 1.1.2). After patching, monitor for any signs of exploitation attempts by reviewing web server access logs and application logs for unusual requests or errors.

Proactive Monitoring: Security teams should monitor for POST requests containing serialized PHP objects (e.g., patterns like O:4:"...) in web server access logs. Monitor for unexpected process execution by the web server's user account (e.g., www-data, apache) and any unusual outbound network connections from the web server, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block PHP object injection and deserialization attacks. Restrict access to the plugin's functionality if possible, and ensure the web server process is running with the lowest possible privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 18, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the common nature of deserialization vulnerabilities, it is highly probable that proof-of-concept exploits will be developed and released by security researchers or malicious actors in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability represents a significant and immediate threat to the organization. We strongly recommend that all WordPress sites using the affected plugin be patched immediately, without delay. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity dictates that it should be treated with the highest priority, as it is a prime target for opportunistic and targeted attacks. Organizations should assume active exploitation is imminent and act accordingly.

Executive Summary:
A critical Cross-Site Request Forgery (CSRF) vulnerability has been identified in the AR For WordPress plugin. This flaw allows an unauthenticated attacker to trick an administrator into unknowingly uploading a malicious file, known as a web shell, which can lead to a complete compromise of the web server, data theft, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2025-60156

Affected Software: AR For WordPress

Affected Versions: All versions through 7.98

Vulnerability: The vulnerability exists because the AR For WordPress plugin fails to implement adequate CSRF protection on its file upload functionality. An attacker can craft a malicious webpage or link that, when visited by an authenticated administrator, forces the administrator's browser to send a hidden request to the vulnerable WordPress site. Because the request is sent from the administrator's authenticated session, the plugin accepts the request and uploads a file provided by the attacker, typically a web shell. This allows the attacker to gain Remote Code Execution (RCE) capabilities on the server, granting them full control over the website and its underlying system.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.6. Successful exploitation would grant an attacker complete control over the affected web server. This could lead to severe business consequences, including the theft of sensitive company and customer data, website defacement, service disruption, and significant reputational damage. The compromised server could also be used as a pivot point to launch further attacks against the internal network or be leveraged in wider malicious campaigns, such as hosting malware or participating in botnets, creating legal and financial liabilities for the organization.

Remediation Plan

Immediate Action: Immediately update the "AR For WordPress" plugin to the latest version available from the vendor (a version higher than 7.98). After patching, thoroughly review web server logs for any signs of compromise, such as unexpected file uploads or suspicious POST requests to plugin endpoints.

Proactive Monitoring: Implement continuous monitoring of web server access and error logs, specifically looking for unusual file upload requests (e.g., .php, .jsp, .aspx files) directed at the plugin's directories. Utilize a File Integrity Monitoring (FIM) solution to alert on the creation of any unauthorized files within the web root. Monitor for unusual outbound network traffic from the web server, which could indicate a web shell communicating with an attacker's command-and-control server.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Disable the "AR For WordPress" plugin until it can be safely updated.
• Implement a Web Application Firewall (WAF) with rules designed to detect and block CSRF attacks and malicious file uploads.
• Restrict administrative access to the WordPress dashboard to trusted IP addresses only.
• Enforce the principle of least privilege by ensuring the web server process has minimal write permissions on the file system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the critical CVSS score of 9.6 and the straightforward nature of the attack, it is highly probable that threat actors will develop and deploy exploits in the near future. The source data contains a discrepancy between the product name ("AR For WordPress" in the description) and the general "Multiple Products" field; this analysis focuses on the specific plugin identified.

Analyst Recommendation

This is a critical vulnerability that enables a full server compromise. Organizations using the "AR For WordPress" plugin on versions 7.98 and below must treat this as a high-priority incident. We strongly recommend applying the vendor-supplied patch immediately to all affected systems. Although this vulnerability is not currently listed on the CISA KEV catalog, its severity warrants urgent action. If patching is delayed, immediately implement the compensating controls listed above, starting with disabling the plugin, to reduce the risk of exploitation.

Executive Summary:
A high-severity vulnerability has been identified in multiple wpshuffle Subscribe products, which could allow an attacker to access sensitive files on the server. This flaw, known as Local File Inclusion, could be exploited to read confidential data, such as configuration files containing database credentials, or to execute malicious code. Successful exploitation could lead to a full compromise of the affected web server, resulting in data breaches and operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-60153

Affected Software: wpshuffle Subscribe Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Improper Control of a Filename for an Include/Require Statement in PHP, commonly known as Local File Inclusion (LFI). An attacker can manipulate an input parameter that the application uses to build a file path for a PHP include or require statement. By crafting a malicious input (e.g., using directory traversal sequences like ../../..), an attacker can force the application to include and execute arbitrary PHP files already present on the server or read the contents of any file readable by the web server process, such as /etc/passwd or wp-config.php.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation can lead to significant business consequences, including the unauthorized disclosure of sensitive information such as customer data, intellectual property, and system credentials. An attacker could leverage this access to gain full control of the web server, deface the website, install malware, or use the compromised server as a pivot point for further attacks into the corporate network. The potential outcomes include severe reputational damage, financial loss from remediation efforts, and possible regulatory penalties.

Remediation Plan

Immediate Action: Apply vendor-supplied security updates to all affected products immediately to patch the vulnerability. Following the update, closely monitor systems for any signs of exploitation attempts by reviewing web server and application access logs for suspicious requests.

Proactive Monitoring: Security teams should actively monitor web server logs for patterns indicative of LFI attacks. This includes searching for requests containing directory traversal sequences (../), references to sensitive system files (e.g., wp-config.php, /etc/passwd), and PHP wrappers like php://filter. Monitor for unexpected file modifications or the creation of new files in web-accessible directories.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block LFI attack patterns. Additionally, harden the server's PHP configuration by disabling allow_url_include and enforcing strict file permissions to limit the web server process's access to only necessary files and directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 26, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, LFI vulnerabilities are well understood and relatively easy to exploit, so it is highly likely that threat actors will develop exploits in the near future. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and the potential for complete server compromise, it is strongly recommended that the organization prioritizes the immediate application of vendor-supplied security patches across all affected systems. Although this CVE is not yet on the CISA KEV list, its critical nature warrants urgent attention. Organizations should treat this as a critical threat and act swiftly to mitigate the risk of a potential data breach or system compromise.