What is the CVSS score of CVE-2025-62008?

CVE-2025-62008 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WooCommerce Product Table are affected by CVE-2025-62008?

The Acowebs Product Table for WooCommerce plugin, used on WordPress storefronts through version 1.2.4, contains a high-severity flaw that lets anyone holding a basic customer or subscriber account…

How to fix or mitigate CVE-2025-62008?

Within 24 hours, inventory every WordPress and WooCommerce installation running Acowebs Product Table for WooCommerce at or below version 1.2.4, and where the plugin is not business-critical, deactivate and remove it; for sites that must keep it live, disable public user registration and change default new-user roles to the most restrictive setting available, and add virtual patching or WAF rules that block requests containing serialized PHP object payloads (for example, patterns matching 'O:' followed by a digit and class name) targeting the plugin's endpoints. Within 7 days, contact Acowebs for a fixed release timeline and confirm whether a 1.2.5 or later version is pending; audit existing subscriber and customer accounts for suspicious or unexpectedly privileged registrations, review WordPress, WooCommerce, and third-party plugin/theme versions to reduce the availability of POP gadget chains, and enforce least privilege on all non-administrative roles. Within 30 days, if no vendor fix has been issued, migrate to an alternative product table plugin or implement a maintained replacement, re-validate that no serialized-input paths remain in any custom integrations, and add continuous monitoring for unexpected object instantiation, file writes, or outbound connections from the web tier; escalate to a formal risk acceptance decision if the plugin must remain in place unpatched.

WooCommerce Product Table CVE-2025-62008

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Woocommerce Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable plugin endpoint (AV:N) exploitable by a low-privilege authenticated user (PR:L) with no interaction; object injection can yield full C/I/A compromise, so all impacts High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 12:23 vuln.today

CVE Published

Oct 22, 2025 - 15:16 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.4.

AnalysisAI

PHP object injection in the Acowebs Product Table For WooCommerce plugin (affected through version 1.2.4) lets an authenticated attacker supply serialized PHP data that the plugin passes to unserialize(), potentially leading to arbitrary object instantiation within the WordPress process. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) and requires a valid low-privilege WordPress session - such as a subscriber or WooCommerce customer account on stores that permit open registration; concrete impact such as file deletion, data exfiltration, or remote code execution depends on the presence of a usable POP gadget chain in WordPress core, WooCommerce, or installed themes/plugins, which is not confirmed in the source data. No public exploit identified at time of analysis, the issue does not appear in CISA KEV, and EPSS is 0.52% (42nd percentile), indicating low predicted exploitation activity at this time.

Technical ContextAI

This is a CWE-502 deserialization-of-untrusted-data flaw in a WordPress plugin distributed by Acowebs. The plugin accepts input that is processed through PHP's unserialize(), allowing an attacker who controls that data to instantiate arbitrary PHP objects. Object injection alone does not guarantee code execution: impact materializes only when the attacker can chain a __wakeup(), __destruct(), or similar magic method from a class that is autoloaded in the target environment - a PHP POP (property-oriented programming) gadget chain. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms network-reachable, low-complexity exploitation, a low-privilege authenticated actor (PR:L), no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact in the assessed worst case. No CPE identifiers were supplied in the intelligence feed, but the affected code base is the WordPress plugin slug product-table-for-woocommerce, versions from n/a through 1.2.4, running on WordPress alongside WooCommerce.

Affected ProductsAI

The affected product is the Acowebs Product Table For WooCommerce WordPress plugin, plugin slug product-table-for-woocommerce, all versions through and including 1.2.4. It is deployed as a WooCommerce storefront extension on WordPress, so any site hosting that plugin version plus WooCommerce is in scope; free or low-privilege user accounts, including subscribers or store customers on sites with open registration, are sufficient to reach the vulnerable code path. No CPE strings were provided in the feed. The authoritative advisory is the Patchstack entry at https://patchstack.com/database/Wordpress/Plugin/product-table-for-woocommerce/vulnerability/wordpress-product-table-for-woocommerce-plugin-1-2-4-php-object-injection-vulnerability?_s_id=cve.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed version number appears in the supplied data, so administrators should not assume an upgrade target exists yet. As an immediate compensating control, deactivate and remove the Product Table For WooCommerce plugin if its product-table display feature is not business-critical - the trade-off is loss of that storefront functionality, but it fully removes the vulnerable code path. Where the plugin must remain, close WooCommerce/WordPress user registration, audit and remove unnecessary subscriber or customer accounts, and apply least privilege so PR:L escalation is harder to obtain; note that this does not eliminate risk for existing low-privilege users. Deploy a web application firewall with virtual patching aimed at blocking serialized object payloads (O: patterns, base64-encoded serialize strings, and PHP object payloads) sent to plugin endpoints - false positives against legitimate store data are possible. Monitor the Patchstack advisory URL referenced above for a vendor fix and apply it as soon as a patched version is published; upgrading without a confirmed fixed release should not be assumed to remediate the issue.