WordPress Rapyd Payment Extension for WooCommerce PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the Rapyd Payment Extension for WooCommerce, affecting versions through 1.2.0. This vulnerability could lead to various impacts, including code execution, SQL injection, path traversal, and denial-of-service, depending on the presence of a suitable object injection chain.

Impact

Exploitation of this vulnerability allows for PHP object injection, which could be leveraged to execute arbitrary code, inject malicious SQL, traverse file paths inappropriately, cause a denial-of-service, or potentially exploit other vulnerabilities, if a proper object injection chain is available.

Remediation

Users are advised to update the Rapyd Payment Extension for WooCommerce to version 1.2.1 or later. Patchstack users can enable auto-update for vulnerable plugins.