CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through <= 1.2.6.
Explanation of Vulnerability in Simple Terms
WPC Shop as a Customer for WooCommerce versions up to 1.2.6 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary PHP code on the site. The vulnerability exists in how the plugin processes untrusted serialized data without proper validation. An attacker with low-level access can exploit this to gain full control of the WordPress installation.
What an attacker can do
Run arbitrary PHP code on the site and take full control of WordPress.
Potential impact on your site
Complete site compromise possible; attacker can modify content, steal data, install malware, or lock out administrators.
Conditions required to exploit
Attacker must have a low-level user account (subscriber or above) on the WordPress site.
Key dates
External resources
Related vulnerabilities
