What is the CVSS score of CVE-2026-27045?

CVE-2026-27045 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Woocommerce Infinite Scroll are affected by CVE-2026-27045?

CVE-2026-27045 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-27045?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Woocommerce Infinite Scroll CVE-2026-27045

EUVD-2026-15760 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-5mg7-jhw3-8jvg

WordPress Deserialization Woocommerce Infinite Scroll Wordpress Plugin

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15760

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.

AnalysisAI

A PHP object injection vulnerability exists in the sbthemes WooCommerce Infinite Scroll plugin (versions up to and including 1.6.2) due to unsafe deserialization of untrusted data. This vulnerability allows attackers to inject malicious serialized objects, potentially leading to remote code execution or arbitrary object instantiation depending on available gadget chains within the WordPress environment. The vulnerability affects all installations of this plugin through version 1.6.2 and has been documented by Patchstack, though CVSS scoring and exploitation metrics are currently unavailable.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a critical weakness where PHP's unserialize() function or similar mechanisms are applied to user-controlled input without proper validation. The sbthemes WooCommerce Infinite Scroll plugin (cpe:2.3:a:sbthemes:woocommerce_infinite_scroll:*:*:*:*:*:*:*:*) likely processes serialized objects from request parameters, cookies, or database entries without sanitization. In WordPress contexts, this is particularly dangerous because the plugin operates within a mature framework containing numerous gadget chains (sequences of existing PHP classes with magic methods like __wakeup, __destruct, or __toString) that attackers can chain together to achieve code execution. The attack leverages the automatic invocation of object methods during deserialization to trigger unintended operations.

RemediationAI

Immediately upgrade the sbthemes WooCommerce Infinite Scroll plugin to a version newer than 1.6.2; consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/sb-woocommerce-infinite-scroll/vulnerability/wordpress-woocommerce-infinite-scroll-plugin-1-6-2-php-object-injection-vulnerability?_s_id=cve) for the specific patched version release. If a patched version is not yet available, disable the plugin entirely until an update is released, as this vulnerability is not practical to mitigate through configuration alone given its nature as a code-level deserialization flaw. As a temporary containment measure, implement Web Application Firewall rules to block requests containing serialized PHP objects (patterns like O:\d+:"class") and restrict administrative access to WordPress to trusted IP ranges. Ensure all WordPress core, theme, and other plugins are kept current, as do they may contain gadget chains that could be chained with this vulnerability.