WooCommerce Multilingual EUVD-2026-96512

Requires an authenticated session with the WooCommerce/WordPress 'shop_manager' role (or higher) on a site running WooCommerce Multilingual & Multicurrency version 5.5.8 or earlier; the attacker must reach a plugin input that is deserialized via unserialize() and supply a crafted serialized PHP object. Exploitation is limited by: the need for an existing high-privilege account (not available to anonymous visitors or ordinary customers/subscribers), and the requirement that a usable POP gadget chain exists in the loaded code for the object injection to achieve code execution rather than a benign object instantiation. No end-user interaction (UI:N) is needed beyond the attacker's own authenticated request.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable but high-privilege flaw: an attacker must already hold a shop-manager-level account, which the vulnerability name explicitly confirms ('Shop manager PHP Object Injection'). This is a meaningful constraint - it is not remote-unauthenticated, so real-world risk is gated by whether an attacker can obtain or compromise a shop_manager role. No EPSS score was supplied, no CISA KEV listing is present, and no public PoC is referenced, so there is no signal of active or imminent mass exploitation. Patchstack reported it, which is a credible WordPress-ecosystem source, but the single reference is a database entry rather than a vendor advisory confirming a fixed version. Net assessment: a genuinely high-impact (full C/I/A compromise via CWE-502 object injection) but privilege-gated issue - a priority to patch for multilingual WooCommerce stores that grant shop-manager accounts to semi-trusted users, but not a drop-everything internet-wide emergency absent any exploitation evidence. SSVC-style read: exploitation = none observed, automatable = no (requires authenticated privileged session), technical impact = total.

An attacker who controls or compromises a WordPress shop-manager account submits a crafted serialized PHP payload to an input that the plugin passes to unserialize(), triggering PHP Object Injection. If a suitable POP gadget chain is present in WooCommerce, WordPress core, or other installed plugins, this leads to remote code execution, data disclosure, or site compromise. No public exploit code is referenced at time of analysis, and exploitation requires an existing high-privilege (shop manager) session.