Hide Shipping Method For Woocommerce
Monthly
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.
PHP object injection in the Hide Shipping Method For WooCommerce plugin (versions up to and including 1.5.4) allows an authenticated user with Editor-level or higher privileges to trigger deserialization of untrusted data on WordPress sites that also run WooCommerce, potentially leading to remote code execution, arbitrary file access, or data manipulation if a suitable gadget chain exists in the plugin, core, or other installed components. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) confirms the attack is network-reachable and requires no user interaction, but the high privilege prerequisite substantially limits exposure. No public exploit identified at time of analysis, no confirmed in-the-wild exploitation, and no fixed plugin version is listed in the available Patchstack advisory.