This vulnerability is a PHP Object Injection flaw in the Shop Manager component of the Music Player for WooCommerce plugin. By injecting crafted serialized data, an attacker could create unwanted object instances during plugin execution. The deserialization routine accepts untrusted input, which aligns with CWE‑502 and can lead to unintended code execution, unauthorized data manipulation, or other forms of compromise if the attacker can supply the malicious payload.

The affected product is the Music Player for WooCommerce plugin developed by codepeople. Versions up to and including 1.9.1 contain the flaw. The fix is available in version 1.9.2 and later.

The CVSS score of 7.2 indicates moderate to high severity, while the EPSS score is not available, so an exact exploitation probability cannot be quantified. The weakness is not listed in the CISA KEV catalog. The likely attack vector is through the Shop Manager interface, which may be restricted to authenticated users. If an attacker can supply crafted serialized input to that interface, the vulnerability could be exploited to achieve code execution or other malicious actions. The broad usage of the plugin means that many sites may be exposed if unpatched.