WordPress Welcart e-Commerce Plugin PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress Welcart e-Commerce plugin, affecting versions through 2.11.16. This vulnerability could lead to PHP object injection, with potential consequences such as code execution, SQL injection, path traversal, or denial of service, depending on the presence of a suitable PHP object injection chain.

Impact

Exploitation of this vulnerability allows for PHP object injection, which could be leveraged to execute arbitrary code, inject malicious SQL, traverse file paths inappropriately, cause a denial of service, or exploit other vulnerabilities, if a proper object injection chain is available.

Remediation

Users of the Welcart e-Commerce plugin should update to version 2.11.17 or later. Patchstack users can enable auto-updates for vulnerable plugins.