CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.
Explanation of Vulnerability in Simple Terms
Product Feed for WooCommerce versions up to 2.3.3 contain a deserialization vulnerability in how they process untrusted data. An authenticated administrator can craft malicious serialized input to execute arbitrary PHP code on the site. This requires admin-level access but can lead to complete site compromise including data theft and modification.
What an attacker can do
Run arbitrary PHP code on the site and access or modify any data.
Potential impact on your site
A compromised admin account can fully compromise your site, steal customer data, and modify product feeds.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
