The Product Feed PRO for WooCommerce plugin up to version 13.5.7 deserializes data supplied by an attacker without sufficient validation, creating PHP Object Injection. This flaw allows a remote attacker to craft serialized payloads that result in the creation and execution of arbitrary PHP objects, thereby achieving remote code execution with administrative privileges on the affected WordPress site.

Any WordPress installation that has the Rymera Web Co Product Feed PRO for WooCommerce plugin version 13.5.7 or earlier is vulnerable. The issue specifically affects the plugin’s deserialization routine used when processing product feed imports or related data.

The vulnerability has a CVSS score of 7.2, indicating high severity. EPSS data is not available and the CVE is not listed in the CISA KEV catalog, so no widespread exploitation has been reported, yet the potential impact remains significant. The likely attack vector is through network requests that provide serialized data to the plugin, such as importing product feeds or submitting plugin configuration. Because the flaw enables full remote code execution, it poses a serious risk until a patch is applied.