The vulnerability is a PHP Object Injection flaw caused by deserialization of arbitrary data in the CoinPayments.net Payment Gateway for WooCommerce plugin. An attacker can craft a malicious serialized payload that, when processed by the plugin, instantiates objects with arbitrary properties and triggers the execution of arbitrary PHP code. This flaw, classified as CWE‑502, enables a determined adversary to compromise the confidentiality, integrity, and availability of the affected WordPress site. The CVSS score of 9.8 reflects the high potential impact of remote code execution.

The affected product is CoinPayments.net Payment Gateway for WooCommerce for WordPress. Versions from the first released build up through 1.0.17 are vulnerable; no minimum version is specified, meaning any installation of this plugin up to 1.0.17 is at risk.

The EPSS score is below 1%, indicating that while the probability of exploitation is low, the high CVSS score still demands attention. The plugin is not listed in the CISA KEV catalog, so no public exploit is currently documented. The likely attack vector is via a crafted HTTP request to the plugin’s endpoints that carries untrusted serialized data; it is inferred that the plugin may accept such input from unauthenticated or low‑privilege users, making the flaw exploitable without explicit access rights.