CVE-2025-60225: critical vulnerability in AncoraThemes BugsPatrol
WordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The BugsPatrol WordPress theme before version 1.5.1 has a flaw where it processes untrusted data without proper validation, allowing attackers to inject malicious objects into the system. This can lead to remote code execution and full compromise of the website.
The vulnerability exists in unsafe PHP deserialization of untrusted input, allowing remote attackers to instantiate arbitrary objects. No authentication is required; the attack vector is network-based via crafted serialized data. Successful exploitation results in arbitrary code execution with web server privileges.