The vulnerability CVE-2025-60228 affects designthemes Knowledge Base versions up to 2.9. It arises from unsafe deserialization of untrusted data, enabling attackers to perform object injection. This can result in remote code execution or other severe impacts. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required. The vulnerability is not related to a cloud service, and no known exploits are reported in the wild. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected Knowledge Base system, including unauthorized disclosure, modification, or destruction of data, and potential system takeover. The attack can be performed remotely with low privileges and does not require user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected application and monitor for unusual activity related to deserialization processes. Avoid processing untrusted serialized data if possible.