CVE-2025-62008 HIGH

CVE-2025-62008: WordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerability

Vendor Acowebs
Product Product Table For WooCommerce
Weakness CWE-502 · Unsafe deserialization
Published October 22, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.4.

Explanation of Vulnerability in Simple Terms

02Summary

Product Table For WooCommerce versions up to 1.2.4 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary code on the site. The plugin unsafely processes serialized data without proper validation, enabling an attacker with low-level access to inject malicious PHP code. This affects confidentiality, integrity, and availability of the entire WordPress installation.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site and take full control of the WordPress installation.

Potential impact on your site

04Site Impact

Complete compromise of the WordPress site, including data theft, malware injection, and site defacement.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account (subscriber or above) and network access to the site.

Key dates

06Disclosure timeline

October 22, 2025 CVE published
April 28, 2026 Record updated