The WooCommerce Product Multi-Action plugin allows an attacker to inject arbitrary objects through deserialization of untrusted data. This Object Injection flaw can lead to execution of malicious code on the server, resulting in full compromise of the WordPress site, data theft, and site sabotage. The weakness is identified as CWE‑502 and is represented in the plugin’s code by accepting serialized payloads without proper validation.

All installations of BestWpDeveloper's WooCommerce Product Multi-Action plugin with versions up to and including 1.3 are affected. The vulnerability applies to any WordPress site using this plugin, regardless of other plugins or themes present.

The weakness carries a CVSS score of 9.8 and an EPSS score of less than 1%, indicating that while the severity is critical, the likelihood of exploitation in the wild is low at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‐based, where adversaries can send crafted serialized data through plugin endpoints or administrative forms. If successful, an attacker could gain complete control over the affected site.