Dotstore WooCommerce Category Banner Management Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Dotstore WooCommerce Category Banner Management plugin, specifically in versions through 2.5.1. This vulnerability arises from the improper handling of untrusted data, which could potentially be exploited if a suitable property-oriented programming (POP) chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of an appropriate POP chain.

Remediation

Users are advised to update to a version later than 2.5.1. For those using Patchstack, a mitigation rule has been issued to block attacks until an official patch can be safely applied.