PHP Object Injection Vulnerability in WooCommerce Recover Abandoned Cart Plugin by WordPress

CVE-2025-0956

What is CVE-2025-0956?

The WooCommerce Recover Abandoned Cart plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input from the 'raccookie_guest_email' cookie. This vulnerability allows unauthenticated attackers to potentially inject PHP Objects. While there is currently no known PHP Object Pop chain present in the affected software, its existence on the site through another plugin or theme could enable attackers to execute harmful actions such as file deletion, data retrieval, or remote code execution. Users are advised to review their installed plugins and themes for possible vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References