The WP eCommerce WordPress plugin through version 3.15.1 unserializes untrusted user input via AJAX actions, enabling an attacker who does not need to authenticate to trigger PHP Object Injection whenever a compatible gadget is present on the site’s codebase; this flaw falls under CWE‑502 and can potentially allow the attacker to execute arbitrary logic on the server.

WordPress sites running the WP eCommerce plugin version 3.15.1 or earlier are affected; the vulnerability resides in the plugin’s core code and requires the presence of a PHP gadget to fully exploit.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is unauthenticated and easy to trigger, but practical exploitation depends on a suitable gadget, which may limit real‑world risk. The vulnerability is not listed in the CISA KEV catalog.