PHP Object Injection Vulnerability in Product Import Export for WooCommerce by WordPress

CVE-2025-1913

What is CVE-2025-1913?

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input from the 'form_data' parameter. This vulnerability affects all versions up to and including 2.5.0 and allows authenticated attackers with Administrator-level access or higher to inject arbitrary PHP objects. While no known PHP Object Pollution (POP) chain exists within the vulnerable software itself, the exploitation of this flaw can lead to significant risks if additional plugins or themes containing a POP chain are present. Such scenarios could enable attackers to perform dangerous actions like file deletion, sensitive data retrieval, or unauthorized code execution.

References