Security readout for executives and security teams
Plain-English summary
This CVE describes an unauthenticated PHP object injection flaw in the WordPress ThemeREX Addons plugin. If exploitable on a public site, it could let an attacker compromise confidentiality, integrity, and availability. Treat exposed WordPress sites using this plugin as urgent until version status and vendor guidance are confirmed.
Executive priority
Prioritize this as critical for any public WordPress estate using ThemeREX Addons. The business risk is potential full site compromise, but remediation decisions should be grounded in confirmed vendor guidance because the supplied version evidence is not fully consistent.
Technical view
The issue is classified as CWE-502 deserialization/PHP object injection in ThemeREX Addons, package trx_addons. The CVSS 3.1 score is 9.8 with network, low-complexity, no-auth, no-user-interaction characteristics. The bundle states affected versions are <= 2.36.1.1, while the Patchstack URL text references 2.35.3, so confirm exact ranges with vendor sources.
Likely exposure
Exposure is most likely on internet-facing WordPress sites with ThemeREX Addons installed. The source bundle identifies the WordPress plugin package as trx_addons. Evidence for exact affected versioning is incomplete because the affected record lists versions as n/a while the description names <= 2.36.1.1.
Exploitation context
No source in the supplied bundle states active exploitation, and KEV is false. The vulnerability is still high urgency because unauthenticated network-reachable PHP object injection can be severe when a vulnerable plugin is present and reachable on a public WordPress site.
Researcher notes
Focus validation on plugin presence, exact version, public reachability, and vendor-confirmed affected range. Do not assume exploitation in the wild from the supplied evidence. The key technical concern is unsafe PHP object handling reachable without authentication, mapped to CWE-502 and CVSS 9.8.
Mitigation direction
- Inventory WordPress sites for the ThemeREX Addons plugin package trx_addons.
- Check ThemeREX and Patchstack guidance for the confirmed fixed version or mitigation.
- Update the plugin if a fixed version is available from trusted sources.
- Disable or remove the plugin where business impact permits until guidance is confirmed.
- Prioritize public, unauthenticated WordPress sites before internal or restricted deployments.
Validation and detection
- Confirm whether ThemeREX Addons is installed on each WordPress site.
- Record the installed plugin version and compare it with vendor and Patchstack advisories.
- Review web and application logs for unusual unauthenticated activity around plugin endpoints.
- Verify compensating controls such as WAF rules or restricted exposure are active.
- Document sites where version evidence is uncertain for follow-up review.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-60205 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wordpress-themerex-addons-plugin-2-35-3-php-object-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.