CVE-2025-60084 HIGH

CVE-2025-60084: WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

Vendor Add-Ons.org
Product PDF for Elementor Forms + Drag And Drop Template Builder
Weakness CWE-502 · Unsafe deserialization
Published December 18, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.

Explanation of Vulnerability in Simple Terms

02Summary

The PDF for Elementor Forms plugin through version 6.5.0 deserializes untrusted data without proper validation. An authenticated attacker with low privileges can send a crafted request to execute arbitrary PHP code on the site, gaining full control over the WordPress installation. This affects all versions from 0 through 6.5.0.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site and take full control of the WordPress installation.

Potential impact on your site

04Site Impact

Complete site compromise: attacker can modify content, steal data, install malware, or lock out administrators.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (subscriber or above) on the site.

Key dates

06Disclosure timeline

December 18, 2025 CVE published
April 28, 2026 Record updated