The vulnerability arises from improper deserialization of untrusted data in the Product Configurator for WooCommerce plugin, allowing an attacker to inject malicious PHP objects. This flaw is identified as CWE-502 and can enable arbitrary code execution if an attacker can control the serialized payload processed by the plugin. The injected object can override properties or invoke methods that grant the attacker elevated privileges or further compromise the hosting WordPress site.

The affected product is the WordPress Product Configurator for WooCommerce plugin developed by mklacroix, with all releases up to and including version 1.7.5 vulnerable. Any WordPress site that has this plugin installed at these or earlier versions is at risk unless the plugin is updated.

The CVSS score of 7.2 indicates a high severity risk, and while the EPSS score is not available, the lack of inclusion in the CISA KEV catalog does not diminish the potential impact. The likely attack vector is a web-based request that includes a crafted serialized string, which the plugin deserializes without proper validation. Although the exact prerequisite conditions are not detailed in the advisory, an attacker who can submit such a payload—whether through a public-facing form or a privileged user session—could potentially execute arbitrary code on the server.