Reycob Product Import Export
Monthly
PHP Object Injection in the Reycob Product Import Export plugin (versions up to and including 2.3.0) allows an authenticated attacker with the WooCommerce 'Shop manager' role or higher to submit crafted serialized data, potentially achieving arbitrary code execution if a suitable POP gadget chain is present in the loaded PHP codebase. The vulnerability is network-exploitable (CVSS 3.1: 7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but the high-privilege requirement limits exploitation to trusted roles. No public exploit code or active exploitation has been identified at the time of analysis.
PHP Object Injection in the Reycob Product Import Export plugin (versions up to and including 2.3.0) allows an authenticated attacker with the WooCommerce 'Shop manager' role or higher to submit crafted serialized data, potentially achieving arbitrary code execution if a suitable POP gadget chain is present in the loaded PHP codebase. The vulnerability is network-exploitable (CVSS 3.1: 7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but the high-privilege requirement limits exploitation to trusted roles. No public exploit code or active exploitation has been identified at the time of analysis.