Product Configurator for WooCommerce CVE-2026-105872

Exploitation requires an authenticated, high-privileged account (PR:H per the CVSS vector - typically administrator or shop-manager) on a WordPress site running the Product Configurator for WooCommerce plugin at version 1.7.5 or earlier, alongside an active WooCommerce installation. The attacker must supply attacker-controlled serialized data to a plugin code path that calls unserialize() on it. Meaningful impact (beyond object instantiation) realistically depends on the presence of a usable POP gadget chain in the plugin, WooCommerce, or WordPress core. Key limiting factors: the privileged-account prerequisite sharply reduces exposure (not reachable by anonymous or low-privilege users), no user interaction is needed (UI:N), and no public exploit or gadget chain is documented, raising the practical bar to independent exploit development.

This is a PHP Object Injection flaw (CWE-502) in the WordPress plugin Product Configurator for WooCommerce, scored CVSS 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The network attack vector and low complexity are offset by PR:H - exploitation requires an already high-privileged (typically administrator) authenticated account, which substantially narrows the real-world attacker population and is the single most important risk-reducing signal here. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public exploit referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The high C/I/A impacts reflect the potential for object-injection-to-code-execution IF a suitable POP gadget chain exists in the plugin, WooCommerce, or WordPress core - a condition the single Patchstack reference does not confirm. Net assessment: a genuine but moderate-priority issue for environments running this specific niche plugin, not a mass-exploitation threat, because the PR:H requirement means an attacker must already hold privileged access. Note the apparent tension: PR:H on an object-injection bug suggests Patchstack treated an admin/privileged role as the exploitation gate rather than any subscriber-level user - verify the exact required role with the vendor advisory before deprioritizing or escalating.

An attacker who already holds a high-privileged (e.g., administrator or shop-manager) account on a WooCommerce store running this plugin submits crafted serialized data to a plugin input that is unserialized without validation. If a usable gadget chain is present in the plugin or its dependencies, the injected object triggers unintended method calls, potentially leading to file operations, data tampering, or remote code execution. No public proof-of-concept is referenced, so weaponization would require the attacker to develop the exploit independently.