What is the CVSS score of CVE-2026-40725?

CVE-2026-40725 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WooCommerce Product Filters are affected by CVE-2026-40725?

WooCommerce Product Filters, a plugin used by hundreds of thousands of WordPress e-commerce sites, contains an unauthenticated critical vulnerability enabling remote code execution without…. A patch is available.

How to fix or mitigate CVE-2026-40725?

Within 24 hours: Disable WooCommerce Product Filters plugin across all WordPress environments. Within 7 days: Monitor official vendor advisory channels for patch availability; evaluate alternative product filter solutions. Within 30 days: Upgrade to WooCommerce Product Filters version 2.0.6 or later once released, or migrate to a patched alternative plugin.

WooCommerce Product Filters CVE-2026-40725

EUVD-2026-37594 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization WordPress Woocommerce Product Filters

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable unserialize() on a WordPress plugin endpoint enables RCE-class POP chains, giving full CIA impact with no privileges or user interaction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:19 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WooCommerce Product Filters Plugin - CVE-2026-40725 Jun 17, 2026

AnalysisAI

Unauthenticated PHP object injection in the WooCommerce Product Filters WordPress plugin (versions prior to 2.0.6) allows remote attackers to deserialize attacker-controlled data and trigger PHP magic methods on existing application gadgets. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-502 root cause, successful exploitation can lead to remote code execution, arbitrary file operations, or full site takeover depending on available POP chains in WordPress core or co-installed plugins. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Barn2 Media's WooCommerce Product Filters plugin for WordPress, which provides AJAX-driven product filtering for WooCommerce storefronts. CWE-502 (Deserialization of Untrusted Data) indicates that the plugin passes untrusted input - likely a filter parameter received over HTTP - into PHP's unserialize() without validation. When unserialize() processes attacker-controlled serialized data, PHP instantiates arbitrary objects and invokes magic methods such as __wakeup, __destruct, or __toString. In a WordPress environment loaded with WooCommerce and other plugins, attackers can chain these magic methods (a 'POP chain' or 'gadget chain') to escalate from object injection to file read/write, SQL execution, or arbitrary code execution. The CPE confirms all versions of barn2_media_ltd:woocommerce_product_filters up to 2.0.6 are affected.

RemediationAI

Upgrade the WooCommerce Product Filters plugin to version 2.0.6 or later, which contains the vendor fix per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-product-filters/vulnerability/wordpress-woocommerce-product-filters-plugin-2-0-6-php-object-injection-vulnerability). If immediate patching is not possible, deactivate the plugin entirely - this disables product filtering UX but eliminates the attack surface. As a temporary compensating control, place a WAF rule (Patchstack, Wordfence, or Cloudflare) that blocks requests to the plugin's AJAX endpoints containing PHP serialized object markers such as 'O:' or 'a:' followed by integer:string patterns; note this may false-positive on legitimate complex filter requests. Audit the WordPress install for indicators of compromise (unexpected admin users, modified core files, suspicious uploads) before applying the patch, since exploitation could predate the update.