PT-2026-50388 · Emv · Creatify

Published 2026-06-17 · Updated 2026-06-17 · CVE-2025-60236

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Creatify versions prior to 1.6

Description A deserialization of untrusted data flaw in the EMV Creatify WordPress theme allows PHP Object Injection. This occurs when attacker-controlled input reaches a PHP deserialization sink, enabling an unauthenticated attacker to inject crafted objects into the application. If paired with a usable gadget chain—a sequence of existing code fragments that can be executed during deserialization—from the theme, an installed plugin, or WordPress core, this can lead to full site compromise. The issue is remotely exploitable without privileges or user interaction.

Recommendations Update to a version newer than 1.5.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-60236

Affected Products

Creatify

References · 2

• https://patchstack.com/database/wordpress/theme/creatify/vulnerability/wordpress-creatify-theme-1-5-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/UpwindMDR/status/2067305697478664568 · Twitter Post