What is the CVSS score of CVE-2026-22480?

CVE-2026-22480 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-22480?

CVE-2026-22480 presents moderate security risk, a insecure deserialization vulnerability rated CVSS 7.2.

How to fix or mitigate CVE-2026-22480?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

WordPress CVE-2026-22480

EUVD-2026-15487 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

WordPress Deserialization

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15487

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.2

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.

AnalysisAI

The WebToffee Product Feed for WooCommerce plugin contains a PHP object injection vulnerability stemming from insecure deserialization of untrusted data (CWE-502), affecting versions up to and including 2.3.3. An attacker can exploit this vulnerability to inject arbitrary objects into the application, potentially leading to remote code execution or data manipulation depending on available gadget chains in the WordPress/PHP environment. No CVSS score or EPSS data is currently published, and active exploitation status is unknown, but the vulnerability has been documented by Patchstack and assigned an ENISA EUVD ID (EUVD-2026-15487), indicating coordinated disclosure tracking.

Technical ContextAI

This vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical class of PHP security defects where user-controlled input is passed to PHP's unserialize() function or similar deserialization mechanisms without proper validation or sanitization. The WebToffee Product Feed for WooCommerce plugin (CPE: cpe:2.3:a:webtoffee:product_feed_for_woocommerce:*:*:*:*:*:*:*:*) runs within the WordPress ecosystem, which provides numerous PHP object classes and magic methods (__wakeup, __destruct, __toString, etc.) that can be chained together as gadgets. An attacker who can control serialized data passed to the plugin's deserialization routine can instantiate arbitrary objects and trigger unintended code execution through these gadget chains, a well-documented attack pattern in WordPress plugin security.

RemediationAI

Upgrade the WebToffee Product Feed for WooCommerce plugin to a version later than 2.3.3 as soon as a patched release is available from the vendor. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/webtoffee-product-feed/vulnerability/wordpress-product-feed-for-woocommerce-plugin-2-3-3-php-object-injection-vulnerability) and the plugin's official repository for patch release announcements. In the interim, if patching is delayed, implement input validation and sanitization for any user-supplied data that may be passed to serialization/deserialization routines; audit WordPress configurations to disable dangerous PHP functions (serialize/unserialize) where feasible via php.ini or security plugins; and restrict access to product feed endpoints via WordPress role-based access controls or WAF rules if the plugin exposes administrative functionality. Monitor for suspicious object instantiation patterns in WordPress logs and consider disabling the plugin entirely until a patch is confirmed available.