The Extra Fees Plugin for WooCommerce (versions ≤4.4.0) contains a PHP Object Injection flaw (CWE‑502). An attacker can supply a crafted serialized object that the plugin deserialises, potentially enabling arbitrary PHP code execution on the WordPress site. This could compromise the integrity and confidentiality of the website, allow data exfiltration, defacement, or full control of the server if the attacker succeeds.

The vulnerability affects the WordPress Extra Fees Plugin for WooCommerce from Dotstore. All releases of the plugin up to and including version 4.4.0 are impacted. The plugin is commonly used on WooCommerce‑based e‑commerce sites built on WordPress.

The CVSS score of 8.8 classifies this as a high‐severity flaw. Although the EPSS score is not available, the lack of a CISA KEV listing does not diminish the potential risk; the weakness could be abused via a specially crafted request to the plugin’s endpoint. The likely attack vector is remote, requiring the attacker to deliver the malicious serialized payload through the plugin’s functionality. Due to the high impact and ease of exploitation, sites that run affected plugin versions should treat this as an urgent risk.