The vulnerability is a PHP Object Injection flaw in the WordPress Minimum and Maximum Quantity for WooCommerce plugin versions 2.1.2 and earlier. Attackers can supply crafted input that triggers unserialization of an arbitrary PHP object, potentially allowing them to execute arbitrary code, elevate privileges, or tamper with site data. The weakness is classified as CWE-502, which indicates untrusted data is deserialized without proper validation.

WordPress sites that have the Dotstore Minimum and Maximum Quantity for WooCommerce plugin installed at version 2.1.2 or earlier are affected. Any instance of the plugin past the 2.1.2 release threshold is not vulnerable.

The CVSS score of 7.2 places the flaw in the high severity range. With no EPSS score reported, the exploitation probability is unclear, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is web-based, where an attacker submits malicious data through the plugin’s input interfaces. If exploited, remote code execution could be achieved on the affected WordPress site.