CVE-2025-60236: EMV Creatify Deserialization Vulnerability

CVE-2025-60236 Overview

CVE-2025-60236 is a PHP Object Injection vulnerability in the EMV Creatify WordPress theme caused by deserialization of untrusted data [CWE-502]. The flaw affects all versions of Creatify up to and including 1.5. An unauthenticated attacker can send crafted serialized payloads over the network to trigger object instantiation inside the theme's PHP runtime. When combined with a suitable gadget chain present in WordPress core, plugins, or other themes, this can lead to remote code execution, arbitrary file operations, or full site compromise.

Critical Impact
Unauthenticated network-based object injection in the Creatify theme can enable arbitrary code execution and complete compromise of WordPress confidentiality, integrity, and availability.

Affected Products

EMV Creatify WordPress theme, versions up to and including 1.5
WordPress sites running the vulnerable theme with unserialize() reachable from user input
Hosting environments exposing the affected WordPress installations to the public internet

Discovery Timeline

2026-06-17 - CVE-2025-60236 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60236

Vulnerability Analysis

The Creatify theme processes attacker-controlled input through PHP's unserialize() function without validating its origin or structure. PHP deserialization reconstructs objects and invokes magic methods such as __wakeup(), __destruct(), and __toString() during the process. An attacker who controls the serialized stream can therefore instantiate arbitrary classes available in the WordPress runtime.

WordPress installations typically load dozens of classes from core, plugins, and themes. Many of these contain usable gadgets that translate object instantiation into file writes, SQL execution, or command execution. The attack is reachable over the network without authentication or user interaction.

Impact extends across confidentiality, integrity, and availability. Successful exploitation commonly results in webshell deployment, persistence inside wp-content, credential theft from wp-config.php, and pivoting to adjacent infrastructure.

Root Cause

The root cause is unsafe deserialization of attacker-supplied data inside the theme's request handling code. The theme passes untrusted strings to unserialize() rather than using safe data formats such as JSON. This is a textbook instance of CWE-502, Deserialization of Untrusted Data.

Attack Vector

An unauthenticated attacker submits a crafted serialized PHP object to a vulnerable endpoint exposed by the Creatify theme. The payload is typically delivered through cookies, POST parameters, or query strings consumed by theme code. When the server deserializes the payload, gadget chains trigger code paths that execute attacker-defined behavior. No prior credentials, privileges, or victim interaction are required.

No verified public proof-of-concept code is currently available. Refer to the Patchstack WordPress Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-60236

Indicators of Compromise

Inbound HTTP requests containing serialized PHP markers such as O:, a:, or s: in cookies, POST bodies, or query strings targeting the Creatify theme paths under /wp-content/themes/creatify/.
Unexpected PHP files created or modified in wp-content/uploads/, wp-content/themes/, or the WordPress root after suspicious requests.
New or modified administrator accounts and unexpected outbound connections from the web server process.

Detection Strategies

Inspect web server and WAF logs for serialized object signatures targeting theme endpoints, focusing on unauthenticated requests with Content-Type: application/x-www-form-urlencoded carrying object markers.
Monitor PHP error logs for __wakeup, __destruct, or class-not-found warnings that often accompany failed gadget chains.
Correlate web request anomalies with process-level telemetry showing php-fpm or apache spawning shells, curl, wget, or compiler binaries.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation directory, especially the themes/creatify/ and uploads/ paths.
Alert on egress traffic from web server identities to unrecognized hosts or non-standard ports.
Track creation of WordPress administrator accounts and changes to wp_optionssiteurl or home values.

How to Mitigate CVE-2025-60236

Immediate Actions Required

Inventory all WordPress sites and identify those running the EMV Creatify theme at version 1.5 or earlier.
Disable or replace the Creatify theme until a fixed version is confirmed available from the vendor.
Deploy WAF rules that block serialized PHP payloads in requests targeting the theme.
Rotate WordPress administrator credentials, secret keys in wp-config.php, and any database accounts reachable from the affected hosts.

Patch Information

No fixed version has been published in the available advisory data at the time of writing. Consult the Patchstack WordPress Vulnerability Advisory for the latest remediation status and any vendor-issued updates.

Workarounds

Replace the Creatify theme with a maintained alternative until the vendor publishes a patched release.
Restrict access to the WordPress site at the network edge, allowing only known administrative IP ranges during remediation.
Configure a WAF signature to reject request bodies and cookies containing PHP serialization markers such as O: followed by integer length and class name.
Audit installed plugins and themes to remove any unused components that could provide deserialization gadget chains.

bash

# Example WAF rule (ModSecurity) to block PHP object injection patterns
SecRule REQUEST_COOKIES|REQUEST_BODY|ARGS "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:" \
    "id:1060236,phase:2,deny,status:403,log,\
    msg:'CVE-2025-60236 Creatify PHP Object Injection attempt blocked'"