A critical deserialization vulnerability in the Themesflat TF Woo Product Grid Addon for Elementor plugin allows unauthenticated attackers to execute arbitrary code.

The plugin fails to safely handle serialized data, allowing an unauthenticated attacker to perform object injection. This occurs due to improper input validation within the addon, which can be leveraged to achieve remote code execution or other malicious impacts.

This vulnerability carries a CVSS score of 8.1, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain full control over the WordPress site, leading to unauthorized data access, site defacement, or the deployment of persistent backdoors.

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate and remove the TF Woo Product Grid Addon for Elementor plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious serialized strings or unusual HTTP requests targeting the Elementor addon endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common object injection payloads and unauthorized attempts to interact with plugin-specific AJAX actions.

Public Exploit Available: Unknown.

Given the critical nature of object injection vulnerabilities, the absence of a vendor patch necessitates immediate defensive action. Organizations using this plugin should prioritize its removal or isolation to prevent potential compromise of the web application environment.