CVE-2025-60080

Executive Summary

CVE-2025-60080 is a critical deserialization vulnerability in the WordPress plugin "PDF for Gravity Forms + Drag And Drop Template Builder" by Add-ons.org, affecting versions up to and including 6.5.0. This vulnerability allows an unauthenticated attacker to perform Object Injection via deserialization of untrusted data, potentially leading to remote code execution (RCE), data exfiltration, or complete site compromise. The CVSS score of 7.5 (High) reflects the ease of exploitation and severe impact on confidentiality, integrity, and availability. As of this report, no official patch is available, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the nature of the vulnerability.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin's update channel and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – Impact confined to the vulnerable component.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Full data modification possible.
• Availability (A): High – Full system disruption possible.

Threat Level: Critical due to the potential for unauthenticated remote code execution and the lack of a patch.

Deep Dive & Mechanics

The vulnerability resides in the deserialization of user-supplied data within the plugin's PDF generation functionality. The plugin likely uses PHP's unserialize() function on data passed via POST requests or file uploads without proper validation or sanitization. This allows an attacker to inject arbitrary PHP objects, leading to Object Injection.

Attack Vector:

1. An attacker sends a crafted HTTP request to the WordPress site, targeting an endpoint that processes PDF template data (e.g., /wp-admin/admin-ajax.php with specific actions).
2. The request contains a serialized PHP object payload.
3. The plugin's code calls unserialize() on this payload without checking the data integrity.
4. If a suitable gadget chain exists in the WordPress core or installed plugins/themes, the attacker can achieve arbitrary code execution.

Root Cause: The plugin fails to implement secure deserialization practices, such as using json_decode() or validating the serialized data against an allowlist of classes.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes:

Vulnerable Code (Example):

$template_data = $_POST['template_data'];
$template = unserialize(stripslashes($template_data));
// Process $template...

Patched Code (Hypothetical):

$template_data = json_decode(stripslashes($_POST['template_data']), true);
if (is_array($template_data)) {
    // Process $template_data safely...
} else {
    wp_die('Invalid template data.');
}

The patched version replaces unserialize() with json_decode() and adds input validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the vulnerable plugin (version <= 6.5.0) installed and activated.
• Knowledge of a gadget chain (e.g., using WordPress core classes like WP_HTML_Token or Requests_Transport_cURL).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., via fuzzing or reading plugin source).
2. Craft a serialized PHP payload using a tool like phpggc:

   phpggc WordPress/RCE1 system 'id' | base64
   

3. Send the payload via a POST request:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d 'action=pdf_template_save&template_data=<base64_encoded_payload>'
   

4. If successful, the command id executes on the server.

Note: No public PoC exists; this is a theoretical approach.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with large or base64-encoded template_data parameters.
• Look for PHP error logs containing unserialize() errors or unexpected class instantiation.
• Use WAF rules to block serialized PHP objects (e.g., patterns like O:\d+:").

Response:

• Immediately disable the plugin if suspicious activity is detected.
• Isolate the affected server and review logs for signs of compromise.
• Restore from a clean backup if RCE is confirmed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=pdf_template_save or similar.
  • Payloads containing base64-encoded serialized PHP objects (e.g., TzoxMDoiV1BfSFRNTF9Ub2tlbiI6).
• File IOCs:
  • Unexpected files in /wp-content/uploads/ or /tmp/ (e.g., .php webshells).
  • Modified plugin files (e.g., pdf-for-gravity-forms/*.php).
• System IOCs:
  • Unusual processes (e.g., curl, wget, nc) spawned by the web server user.
  • Outbound connections to unknown IPs on ports 80/443.

Detection Engineering

YARA Rule

rule CVE_2025_60080_Deserialization {
    meta:
        description = "Detects serialized PHP objects in HTTP requests targeting PDF for Gravity Forms plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60080"
    strings:
        $serialized = /O:\d+:"[^"]+":\d+:/  // Matches PHP serialized object pattern
        $plugin_path = "pdf-for-gravity-forms"
        $ajax_action = "pdf_template_save"
    condition:
        $serialized and ($plugin_path or $ajax_action)
}

Sigma Rule

title: CVE-2025-60080 - Deserialization Attempt in PDF for Gravity Forms
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects HTTP POST requests containing serialized PHP objects targeting the vulnerable plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=pdf_template_save'
        cs-request-body|re: 'O:\d+:"[^"]+":\d+:'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60080 - Deserialization Attempt in PDF for Gravity Forms"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=pdf_template_save"; http_client_body; pcre:"/O:\d+:\"[^\"]+\":\d+:/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block serialized PHP objects in POST requests.
3. Monitor logs for exploitation attempts using the Sigma/Suricata rules above.

Long-Term Fixes:

• Apply the official patch once released by Add-ons.org.
• Replace unserialize() with json_decode() in custom code.
• Use a security plugin like Wordfence to add virtual patching.

Workarounds:

• Restrict access to admin-ajax.php via .htaccess:

  <Files "admin-ajax.php">
      Require ip 127.0.0.1
  </Files>
  

• Disable PHP deserialization of user input via php.ini (not recommended for production).

Valters IT
Securing Digital Frontiers