The vulnerability in the Multiple Shipping And Billing Address For Woocommerce plugin allows attackers to deserialize untrusted data, leading to PHP object injection. This flaw can be leveraged to execute arbitrary code or commands, granting full control over the affected WordPress site. The weakness is a deserialization flaw (CWE‑502) and directly jeopardizes confidentiality, integrity, and availability of the website.

The flaw impacts the silverplugins217 WordPress plugin named Multiple Shipping And Billing Address For Woocommerce. All releases up to and including version 1.5 are vulnerable; any site using the plugin in this range remains at risk. No mitigated versions are listed beyond the stated cutoff.

With a CVSS score of 9.8, the vulnerability is considered critical. The EPSS score of <1% indicates a low current exploitation probability, and it is not listed in the CISA KEV catalog, suggesting no reported public exploits yet. Attackers would need to supply a malicious serialized payload to a vulnerable endpoint, typically through crafted HTTP requests or plugin‑provided forms. If an attacker gains authenticated access to the plugin’s administration interface, the exploitation complexity reduces, making the attack more feasible. Monitoring for suspicious POST requests to the plugin’s endpoints is recommended until a patch is applied.