WebToffee Product Feed for WooCommerce PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WebToffee Product Feed for WooCommerce plugin, affecting versions through 2.3.3. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and path traversal, especially if a suitable property-oriented programming chain is exploited.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which could be leveraged to execute code injection, SQL injection, path traversal, or a denial-of-service attack, provided that an appropriate property-oriented programming chain is available.

Remediation

Users are advised to update the WebToffee Product Feed for WooCommerce plugin to version 2.3.4 or later. Patchstack users can enable auto-update for vulnerable plugins.