Is CVE-2025-11993 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-11993 being exploited in the wild.

How severe is CVE-2025-11993?

High severity, with a CVSS score of 8.8, published 29 May 2026.

Which products and versions are affected?

BeRocket WooCommerce Infinite Scroll and Ajax Pagination Up to and including 1.8.

Is there a fix for CVE-2025-11993?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-11993 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-11993?

Check whether you run BeRocket WooCommerce Infinite Scroll and Ajax Pagination at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-11993: WooCommerce Infinite Scroll and Ajax Pagination PHP Object Injection

CVE-2025-11993 · Severity: high · CVSS 8.8 · Published 2026-05-29

The WooCommerce Infinite Scroll and Ajax Pagination plugin, which enhances how products are displayed on e-commerce sites, contains a security flaw in its settings import feature. This vulnerability allows logged-in users with low-level permissions, such as customers or subscribers, to upload malicious data that the server processes incorrectly. If successful, an attacker could potentially take control of the website, steal sensitive customer data, or delete important files, depending on other software installed on the site.

Vendors: BeRocket.

Quick answers

Is CVE-2025-11993 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-11993 being exploited in the wild.
How severe is CVE-2025-11993?: High severity, with a CVSS score of 8.8, published 29 May 2026.
Which products and versions are affected?: BeRocket WooCommerce Infinite Scroll and Ajax Pagination Up to and including 1.8.
Is there a fix for CVE-2025-11993?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-11993 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-11993?: Check whether you run BeRocket WooCommerce Infinite Scroll and Ajax Pagination at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection via the 'settings' parameter in the 'import_settings' function. The root cause is the deserialization of untrusted data provided through the configuration import feature without proper capability checks or input validation. Authenticated attackers with Subscriber-level access or higher can exploit this to inject PHP Objects. While the plugin does not contain a native POP chain, the presence of a POP chain in other installed plugins or themes could lead to remote code execution, arbitrary file deletion, or sensitive data retrieval. The vulnerability affects all versions up to and including 1.8.

Affected products

BeRocket WooCommerce Infinite Scroll and Ajax Pagination Up to and including 1.8

Timeline

2026-05-29: advisory: NVD published the CVE record based on Wordfence data.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.