Executive brief
A vulnerability exists in the WooCommerce Product Filters plugin, which is used to add advanced filtering capabilities to WordPress e-commerce sites. An unauthenticated attacker can exploit this flaw to potentially take full control of the website, steal customer data, or disrupt business operations. This is a critical issue because it does not require any login credentials to execute.
Technical details
The WooCommerce Product Filters plugin for WordPress is vulnerable to PHP Object Injection in versions prior to 2.0.6. This occurs due to the deserialization of untrusted data (CWE-502) provided by a user without proper validation. An unauthenticated remote attacker can exploit this by sending a specially crafted request containing a malicious PHP object. If a suitable Property-Oriented Programming (POP) chain is present on the server, the attacker can achieve remote code execution, perform SQL injection, or access sensitive files. The issue is resolved in version 2.0.6.
Affected products
- Barn2 Media Ltd WooCommerce Product Filters < 2.0.6
Timeline
- 2025-12-22: other: Vulnerability reported by Phat RiO
- 2026-04-16: advisory: Patchstack advisory published
- 2026-06-17: disclosed: CVE published to NVD