The vulnerability allows deserialization of untrusted data within the YITHEMES YITH WooCommerce Compare plugin, resulting in object injection that can lead to arbitrary code execution. An attacker could potentially compromise the website’s confidentiality, integrity, and availability by triggering the deserialization process and causing malicious objects to be instantiated and executed on the server.

Affects the YITHEMES YITH WooCommerce Compare WordPress plugin version 3.6.0 and all earlier releases. Users who have installed this plugin on their WordPress sites are at risk until they upgrade beyond the 3.6.0 threshold.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% reflects a low probability of real‑world exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector would involve an attacker sending crafted serialized data to the plugin—potentially through a web request or an administrative interface—triggering the vulnerable deserialization routine. Based on the description, it is inferred that exploitation may require authenticated access with administrative privileges, but the flaw could also be leveraged by unauthenticated users if the plugin accepts external input from such users.