Deserialization of Untrusted Data Vulnerability in WooCommerce Product Multi-Action by BestWpDeveloper
CVE-2025-49417

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WooCommerce Product Multi-action
Vendor
CVE Published:
4 July 2025

What is CVE-2025-49417?

A vulnerability in WooCommerce Product Multi-Action by BestWpDeveloper enables the deserialization of untrusted data, leading to potential object injection. This issue impacts product versions up to 1.3, exposing users to serious security risks as it can allow attackers to manipulate application logic or execute arbitrary code. Users are advised to assess their installations and apply necessary mitigations.

Affected Version(s)

WooCommerce Product Multi-Action <= 1.3

References

https://patchstack.com/database/wordpress/plugin/woo-prod...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO - BlueRock (Patchstack Alliance)
.