PHP Object Injection Vulnerability in WooCommerce Recover Abandoned Cart Plugin by WordPress

CVE-2025-0956

Summary

The WooCommerce Recover Abandoned Cart plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input from the 'raccookie_guest_email' cookie. This vulnerability allows unauthenticated attackers to potentially inject PHP Objects. While there is currently no known PHP Object Pop chain present in the affected software, its existence on the site through another plugin or theme could enable attackers to execute harmful actions such as file deletion, data retrieval, or remote code execution. Users are advised to review their installed plugins and themes for possible vulnerabilities.

References