Executive brief
The WooCommerce Infinite Scroll and Ajax Pagination plugin, which enhances how products are displayed on e-commerce sites, contains a security flaw in its settings import feature. This vulnerability allows logged-in users with low-level permissions, such as customers or subscribers, to upload malicious data that the server processes incorrectly. If successful, an attacker could potentially take control of the website, steal sensitive customer data, or delete important files, depending on other software installed on the site.
Technical details
The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection via the 'settings' parameter in the 'import_settings' function. The root cause is the deserialization of untrusted data provided through the configuration import feature without proper capability checks or input validation. Authenticated attackers with Subscriber-level access or higher can exploit this to inject PHP Objects. While the plugin does not contain a native POP chain, the presence of a POP chain in other installed plugins or themes could lead to remote code execution, arbitrary file deletion, or sensitive data retrieval. The vulnerability affects all versions up to and including 1.8.
Affected products
- BeRocket WooCommerce Infinite Scroll and Ajax Pagination Up to and including 1.8
Timeline
- 2026-05-29: advisory: NVD published the CVE record based on Wordfence data.