The Cost of Goods for WooCommerce plugin contains a PHP object injection flaw in its shop manager component. The vulnerability permits the deserialization of crafted PHP objects, as identified by CWE‑502, allowing an attacker to manipulate the plugin’s input handling. The description indicates only that malicious serialized objects can be injected, without detailing the specific outcome beyond the potential for object code execution.

Affected systems are installations of WPFactory's Cost of Goods for WooCommerce plugin running version 3.5.2 or earlier. The plugin manages cost data in WooCommerce and is widely used on WordPress sites that host e‑commerce stores. Any site that has not upgraded beyond 3.5.2 is potentially vulnerable, regardless of site location.

The CVSS score of 7.2 places the issue in the high‑severity range, yet there is no EPSS score publicly available and the vulnerability is not listed in CISA’s KEV catalog. Based on the nature of the flaw, the likely attack vector would involve sending a crafted payload containing a serialized object via an administrative or API endpoint that the plugin processes. Successful exploitation requires remote access to the plugin’s input handling, and while code execution is a possibility, the CVE data does not guarantee that outcome.