The wpstorecart WordPress plugin contains a deserialization vulnerability that allows unauthenticated attackers to inject arbitrary PHP objects.

The plugin fails to restrict permitted classes during the deserialization of user-supplied input in a bundled add-on. This allows unauthenticated attackers to perform PHP object injection, which can lead to remote code execution if an attacker identifies a suitable gadget chain within the application environment.

This vulnerability carries a CVSS score of 8.1, reflecting the potential for full system compromise. Successful exploitation could grant an attacker the ability to execute arbitrary code with the privileges of the web server, leading to complete loss of confidentiality, integrity, and availability.

Immediate Action: Check for available security updates for the wpstorecart plugin. If an update is unavailable, deactivate or remove the plugin and its associated add-ons to eliminate the attack vector.

Proactive Monitoring: Inspect server logs for unusual serialized data strings or attempts to access plugin-specific endpoints associated with the add-on.

Compensating Controls: Utilize a Web Application Firewall to filter out malicious serialized objects before they reach the application logic.

Public Exploit Available: No

Deserialization flaws are high-risk vulnerabilities that should be addressed immediately. Until a verified patch is applied, it is strongly recommended to restrict access to the affected add-on or remove the plugin entirely to prevent potential remote code execution.