Deserialization of untrusted data in the Welcart e-Commerce plugin permits object injection, which attackers can exploit to execute arbitrary code on the host or alter application behavior. The vulnerability stems from the plugin’s acceptance of serialized objects without adequate validation, exposing the website to compromise of confidentiality, integrity, and availability.

The flaw affects the Welcart e-Commerce WordPress plugin for all releases up to and including 2.11.16. Sites running any version within that range are potentially vulnerable.

The CVSS score of 7.2 reflects a high severity rating, while the EPSS value of less than 1% indicates a very low likelihood of exploitation in the near term and the vulnerability is not listed in CISA’s KEV catalogue. Nevertheless, the attack vector is likely remote via the WordPress web interface or API endpoints that handle plugin data, allowing an attacker to deliver a malicious serialized payload that triggers object injection without needing local access. Successful exploitation could lead to remote code execution or full site compromise.