This vulnerability is a deserialization of untrusted data issue in the PDF for Elementor Forms + Drag And Drop Template Builder plugin from add-ons.org, identified as CVE-2025-60084. It affects all versions up to 6.5.0. The flaw allows an attacker with at least low privileges and no user interaction to perform object injection, potentially leading to full compromise of the system. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or manipulate data within the affected plugin environment, resulting in full compromise of confidentiality, integrity, and availability. This could lead to unauthorized access, data manipulation, or denial of service conditions in systems using the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity related to object injection attempts.