Junglewise Threat Intelligence

CVE-2026-40725: Barn2 WooCommerce Product Filters PHP Object Injection

CVE-2026-40725 · Severity: critical · CVSS 9.8 · Published 2026-06-17

Executive brief

A vulnerability exists in the WooCommerce Product Filters plugin, which is used to add advanced filtering capabilities to WordPress e-commerce sites. An unauthenticated attacker can exploit this flaw to potentially take full control of the website, steal customer data, or disrupt business operations. This is a critical issue because it does not require any login credentials to execute.

Technical details

The WooCommerce Product Filters plugin for WordPress is vulnerable to PHP Object Injection in versions prior to 2.0.6. This occurs due to the deserialization of untrusted data (CWE-502) provided by a user without proper validation. An unauthenticated remote attacker can exploit this by sending a specially crafted request containing a malicious PHP object. If a suitable Property-Oriented Programming (POP) chain is present on the server, the attacker can achieve remote code execution, perform SQL injection, or access sensitive files. The issue is resolved in version 2.0.6.

Affected products

  • Barn2 Media Ltd WooCommerce Product Filters < 2.0.6

Timeline

  • 2025-12-22: other: Vulnerability reported by Phat RiO
  • 2026-04-16: advisory: Patchstack advisory published
  • 2026-06-17: disclosed: CVE published to NVD

References