What is the CVSS score of CVE-2025-11993?

CVE-2025-11993 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WooCommerce Infinite Scroll are affected by CVE-2025-11993?

A PHP object injection vulnerability in WooCommerce Infinite Scroll and Ajax Pagination plugin (versions ≤1.8) enables Subscriber-level users to trigger arbitrary code execution when a vulnerable…

How to fix or mitigate CVE-2025-11993?

Within 24 hours: identify all WordPress sites running versions ≤1.8 of this plugin and audit installed plugins/themes for known PHP gadget chains. Within 7 days: disable the plugin if non-critical functionality, or restrict Subscriber role permissions as an interim control. Within 30 days: identify a patched alternative plugin or prepare for deployment once vendor releases a fix.

WooCommerce Infinite Scroll CVE-2025-11993

EUVD-2025-209981 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-29 Wordfence

GHSA-88pw-x8mv-5vj5

PHP Information Disclosure WordPress Deserialization Woocommerce Infinite Scroll And Ajax Pagination

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 06:44 vuln.today

CVE Published

May 29, 2026 - 05:32 nvd

HIGH 8.8

DescriptionCVE.org

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization of untrusted data supplied via the import configuration feature without capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No POP chain is present within the vulnerable plugin itself, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow an attacker to delete arbitrary files, retrieve sensitive data, or execute code.

AnalysisAI

Authenticated PHP Object Injection in the WooCommerce Infinite Scroll and Ajax Pagination WordPress plugin (versions up to and including 1.8) allows Subscriber-level users to deserialize attacker-controlled data via the 'settings' parameter of the import_settings function. While the plugin itself contains no usable POP chain, the presence of any vulnerable gadget in another installed plugin or theme can escalate this into arbitrary file deletion, sensitive data disclosure, or remote code execution. There is no public exploit identified at time of analysis, but the low privilege barrier and ubiquity of WordPress gadget chains make this a meaningful risk for multi-plugin sites.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data) in the import/export configuration handler of an sbthemes-developed WordPress plugin marketed through CodeCanyon (CPE: cpe:2.3:a:sbthemes:woocommerce_infinite_scroll_and_ajax_pagination). PHP Object Injection arises when user-supplied input is passed to PHP's unserialize() without sanitization or capability gating; in this case the import_settings function lacks both a capability check (so any logged-in user with Subscriber role can invoke it) and any allowlist of expected object types. Because WordPress sites typically run dozens of plugins and themes sharing the same PHP process, a 'POP' (Property-Oriented Programming) gadget chain present anywhere in that shared codebase - even in an unrelated plugin - can be triggered through this sink to reach dangerous methods such as __destruct, __wakeup, or __toString.

RemediationAI

No vendor-released patch identified at time of analysis - the Wordfence advisory and CodeCanyon listing do not document a fixed version above 1.8. Administrators should monitor the CodeCanyon product page (https://codecanyon.net/item/woocommerce-infinite-scroll-and-ajax-pagination/10192075) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a8eb3ec8-0784-4702-86bf-a621b288e7a0?source=cve) for an update and apply it as soon as it is released. In the interim, the most effective compensating controls are to deactivate and remove the plugin until a fix ships (trade-off: loss of infinite-scroll/pagination UX on store pages); disable open user registration on the WordPress site or restrict the default registration role away from Subscriber to break the PR:L precondition (trade-off: blocks legitimate customer self-signup on WooCommerce stores); and add a WAF rule to block POST requests targeting the import_settings action/endpoint, or to reject requests where the 'settings' parameter contains serialized PHP markers such as 'O:' or 'a:' followed by length-prefixed strings (trade-off: may false-positive on legitimate admin imports). Auditing the site for other plugins/themes known to contain POP gadget chains reduces the impact surface even if the sink remains.