Empik EmpikPlace for WooCommerce PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the EmpikPlace for WooCommerce plugin, affecting versions through 1.4.2. This vulnerability could lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, especially if a suitable object injection chain is exploited.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which may lead to arbitrary code execution, SQL injection, path traversal, denial-of-service, and potentially more, depending on the presence of a suitable object injection chain.

Remediation

Users of the EmpikPlace for WooCommerce plugin should update to version 1.4.4 or later. Patchstack users can enable auto-updates for vulnerable plugins.