CVE-2025-60231: The Hospital Object Injection Vulnerability

CVE-2025-60231 Overview

CVE-2025-60231 is a PHP Object Injection vulnerability in the EMV nrghospital (The Hospital) WordPress theme. The flaw stems from deserialization of untrusted data [CWE-502] and affects all theme versions up to and including 1.8.1. An unauthenticated remote attacker can submit crafted serialized data that the theme passes to unserialize(). When combined with a usable property-oriented programming (POP) gadget chain, this can lead to remote code execution, arbitrary file operations, or full site compromise. The vulnerability requires no authentication, no user interaction, and is exploitable across the network.

Critical Impact
Unauthenticated attackers can inject PHP objects into vulnerable WordPress sites running The Hospital theme through 1.8.1, enabling remote code execution and full site takeover.

Affected Products

EMV The Hospital (nrghospital) WordPress theme — versions through 1.8.1
WordPress sites with the vulnerable theme installed and activated
Hosting environments exposing affected theme endpoints to the internet

Discovery Timeline

2026-06-17 - CVE-2025-60231 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60231

Vulnerability Analysis

The vulnerability is a classic PHP Object Injection issue. The theme accepts attacker-controlled input and passes it to PHP's unserialize() function without sufficient validation. PHP deserialization reconstructs arbitrary objects and invokes magic methods such as __wakeup(), __destruct(), __toString(), and __call() during the process. Attackers leverage existing classes loaded by WordPress core, plugins, or other themes to build POP gadget chains that abuse these magic methods.

Because the attack vector is network-based and requires no privileges or user interaction, exploitation can be automated against exposed WordPress installations. Successful exploitation depends on the presence of a viable gadget chain in the broader runtime, which is common in WordPress environments with multiple plugins active.

Root Cause

The root cause is unsafe handling of serialized PHP data within the nrghospital theme code. Rather than using safe data interchange formats such as JSON, the theme deserializes attacker-influenced strings. This pattern directly maps to [CWE-502]: Deserialization of Untrusted Data.

Attack Vector

An attacker sends an HTTP request containing a crafted serialized payload to a vulnerable endpoint exposed by the theme. The theme deserializes the payload, instantiating attacker-chosen objects. The resulting magic method invocations execute a gadget chain that performs file writes, command execution, or arbitrary PHP code execution under the web server account. Refer to the Patchstack WordPress Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-60231

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP patterns such as O: followed by a digit and class name, or a: array markers.
Unexpected PHP files written to wp-content/uploads/, theme, or plugin directories.
New or modified administrator accounts in wp_users not tied to legitimate provisioning.
Outbound network connections from the web server to unknown hosts following theme requests.

Detection Strategies

Inspect web server and WordPress access logs for requests targeting nrghospital theme endpoints carrying serialized payloads.
Apply web application firewall rules that flag unserialize()-style payloads on POST bodies and cookies.
Monitor PHP error logs for deserialization failures, __wakeup exceptions, or class-not-found errors that often accompany failed exploit attempts.

Monitoring Recommendations

Alert on new PHP file creation under wp-content/themes/nrghospital/ and the WordPress uploads directory.
Track process creation by the web server user (www-data, apache, nginx) spawning shells or network utilities.
Forward WordPress, web server, and host telemetry to a centralized analytics platform for correlation across requests, file changes, and process activity.

How to Mitigate CVE-2025-60231

Immediate Actions Required

Identify all WordPress sites using the EMV nrghospital theme and confirm the installed version.
Disable or replace the theme on any site running version 1.8.1 or earlier until a fixed release is verified.
Restrict access to WordPress admin and theme endpoints behind a WAF or IP allowlist.
Audit recent file changes, scheduled tasks (wp_cron), and administrator accounts for signs of compromise.

Patch Information

At the time of publication, the Patchstack advisory indicates the issue affects The Hospital theme through 1.8.1. Apply any vendor-released update beyond 1.8.1 as soon as it becomes available, and validate the fix against the affected endpoints before returning the theme to production.

Workarounds

Remove or deactivate the nrghospital theme until a patched version is confirmed.
Deploy WAF signatures that block PHP serialized object patterns in untrusted input.
Run WordPress under a least-privilege system account and restrict write permissions on theme and plugin directories.
Disable unused PHP classes and limit available gadgets by removing unneeded plugins.

bash

# Example: locate vulnerable theme installations and restrict access
find /var/www -type d -name nrghospital -print

# Deactivate the theme via WP-CLI on affected sites
wp theme activate twentytwentyfour --path=/var/www/site
wp theme delete nrghospital --path=/var/www/site