A critical deserialization vulnerability in the sbthemes WooCommerce Infinite Scroll plugin permits authenticated remote attackers to achieve full system compromise.

The plugin is susceptible to CWE-502: Deserialization of Untrusted Data, which allows an authenticated user with low-level privileges to inject malicious objects into the application. This process can be leveraged to achieve arbitrary code execution on the underlying server.

Successful exploitation grants an attacker the ability to execute arbitrary code within the context of the web server. Given the CVSS score of 8.8, this poses a significant risk to data confidentiality, integrity, and system availability. Unauthorized access to the WordPress environment could lead to full site takeover, data exfiltration, or the deployment of further malicious payloads.

Immediate Action: Since a specific patch version is not currently listed, prioritize disabling or uninstalling the WooCommerce Infinite Scroll plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual POST requests or serialized strings originating from authenticated user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block serialized PHP objects in incoming HTTP requests.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the potential for remote code execution, requires immediate attention from security administrators. We strongly recommend removing the vulnerable plugin from production environments until the vendor provides a secure version, as object injection flaws are frequently targeted for automated exploitation.