The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.8 because the import_settings function deserializes untrusted data from the 'settings' parameter without checking user capabilities. This flaw can allow an authenticated user with Subscriber-level access or higher to inject a PHP object. While the plugin itself contains no proven POP chain, the existence of a POP chain elsewhere on the site could let the attacker delete files, read sensitive data or execute arbitrary code, effectively compromising the application.

The vulnerability affects the sbthemes WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress. All released versions up to 1.8 are vulnerable. Customers using versions 1.8 or earlier with WordPress sites that allow Subscriber or higher level users to use the import configuration feature are at risk.

The CVSS base score of 8.8 marks this flaw as high severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, but the flaw requires an authenticated user, limiting the attack surface. The vulnerability is not yet listed in CISA KEV, but the potential of code execution via an existing POP chain makes it a serious threat. Exploitability would involve uploading a maliciously crafted import file exploiting the deserialization in import_settings and then leveraging any available POP chain on the target system.