CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through <= 1.3.
Explanation of Vulnerability in Simple Terms
WooCommerce Product Multi-Action versions 1.3 and earlier contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary PHP code on affected sites. The plugin unsafely processes untrusted serialized data without validation. No user interaction is required; exploitation can occur over the network. Sites running this plugin are at immediate risk of complete compromise.
What an attacker can do
Run arbitrary PHP code on the site and take full control of it.
Potential impact on your site
Complete site compromise, data theft, malware installation, and defacement are possible without warning.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
