The vulnerability is a deserialization flaw that allows untrusted data to be processed by the WebToffee Product Feed for WooCommerce plugin. This flaw can be used to inject PHP objects with malicious properties, potentially leading to arbitrary code execution and compromising site confidentiality, integrity, and availability. The description does not report a specific exploit, but the nature of object injection is intrinsically dangerous.

WordPress sites running the WebToffee Product Feed for WooCommerce plugin in versions up to and including 2.3.3 are affected. The issue is present in every installation that has not yet upgraded beyond version 2.3.3, regardless of other WordPress components.

With a CVSS score of 7.2 the vulnerability is considered high severity. An EPSS score of less than 1% suggests that active exploitation is unlikely at present, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to require an attacker to supply crafted serialized data via a plugin input or internal data flow; no publicly documented exploitation has appeared yet.