CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.
Explanation of Vulnerability in Simple Terms
WooCommerce Infinite Scroll versions up to 1.6.2 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary code on the site. The plugin unsafely deserializes untrusted data, enabling an attacker with low-level access to run their own PHP code with full site privileges. This affects all installations of the plugin up to version 1.6.2.
What an attacker can do
Run their own code on the site with full administrative privileges.
Potential impact on your site
Any user with basic site access can compromise the entire WordPress installation and steal or modify all data.
Conditions required to exploit
Attacker must have a low-level user account (subscriber, contributor, or similar) on the WordPress site.
Key dates
External resources
Related vulnerabilities
