PHP Object Injection Vulnerability in ThemeREX Addons by ThemeREX
CVE-2025-60205

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Themerex Addons
Vendor
CVE Published:
17 June 2026

What is CVE-2025-60205?

ThemeREX Addons versions up to 2.36.1.1 are susceptible to a PHP Object Injection vulnerability that allows unauthenticated attackers to exploit the application. This flaw may enable attackers to execute arbitrary PHP code, leading to potential data breaches and site compromise. It is crucial for users and administrators of affected versions to apply available updates to mitigate risks.

Affected Version(s)

ThemeREX Addons <= 2.36.1.1

References

https://patchstack.com/database/wordpress/plugin/trx_addo...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
.