An authenticated PHP object injection vulnerability in the WooCommerce Infinite Scroll and Ajax Pagination plugin could allow attackers with low-level privileges to execute arbitrary code.

The plugin fails to safely deserialize untrusted data (CWE-502), allowing an authenticated attacker to inject malicious PHP objects. This can lead to remote code execution, provided the attacker has at least low-level access to the WordPress site.

With a CVSS score of 8.8, this vulnerability represents a severe threat to the integrity and availability of the WordPress site. Successful exploitation grants an attacker the ability to execute code with the permissions of the web server, potentially leading to full site compromise, data exfiltration, or total system takeover.

Immediate Action: No patch is currently available. Administrators should immediately deactivate and remove the "WooCommerce Infinite Scroll and Ajax Pagination" plugin until a secure version is released.

Proactive Monitoring: Monitor WordPress activity logs for suspicious administrative actions or unauthorized file modifications that may indicate exploit attempts.

Compensating Controls: Ensure that WordPress user accounts are strictly managed and that least-privilege principles are applied to prevent unauthorized users from reaching the vulnerable plugin functions.

Public Exploit Available: Unknown.

Because there is no available patch, the most effective remediation is the complete removal of the plugin. Security teams should audit their WordPress installations to identify and decommission the affected software immediately.