WordPress Multiple Shipping and Billing Address for WooCommerce PHP Object Injection Vulnerability

A PHP object injection vulnerability has been identified in the WordPress plugin 'Multiple Shipping and Billing Address for WooCommerce', affecting versions through 1.5. This vulnerability arises from the deserialization of untrusted data, allowing for object injection that could be exploited if a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a proper object-oriented programming chain.

Remediation

Users of the 'Multiple Shipping and Billing Address for WooCommerce' plugin should update to version 1.6 or later. Patchstack users can enable auto-update for vulnerable plugins.