EUVD-2026-89827
GHSA-62xx-gw7g-hr87
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Remote authenticated Author user (PR:H) submits crafted serialized data with no interaction; object injection with a viable gadget chain yields full confidentiality, integrity, and availability impact within the same scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
AnalysisAI
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account at Author privilege level or higher (PR:H) on a site running Minimum and Maximum Quantity for WooCommerce plugin version 2.1.2 or earlier alongside WooCommerce. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-exploitable, low-complexity flaw with full C/I/A impact, but critically requires high privileges (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis: the provided data contains a single Patchstack advisory reference and no fixed version string, so no upgrade target can be named - track https://patchstack.com/database/wordpress/plugin/min-and-max-quantity-for-woocommerce/vulnerability/wordpress-minimum-and-maximum-quantity-for-woocommerce-plugin-2-1-2-php-object-injection-vulnerability?_s_id=cve for a patched release and apply it as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running WooCommerce and confirm which ones have Minimum and Maximum Quantity for WooCommerce installed at version 2.1.2 or earlier, then deactivate and remove the plugin from any storefront that does not strictly require it; where it must stay, audit all Author, Editor and Administrator accounts, revoke stale or unnecessary Author-level privileges, enforce strong unique passwords plus multi-factor authentication, and enable file-integrity and audit logging to catch unexpected object deserialization or file-write activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today