The Pay with Vipps for WooCommerce plugin performs deserialization of data supplied by users without sufficient validation, allowing an attacker to inject malicious PHP objects. This weakness, identified as CWE-502, can enable arbitrary code execution by exploiting the plugin’s object deserialization routine.

The vulnerability affects WP Hosting AS Pay with Vipps for WooCommerce plugin versions up to and including 6.2.0. Only installations of these or earlier releases are impacted; newer plugin versions contain the fix.

With a CVSS score of 7.2, the vulnerability presents a high severity risk. The EPSS value is unavailable, so the probability analysis is incomplete, but the absence of a KEV listing does not reduce the threat. The likely attack vector involves an attacker crafting a malicious serialized payload delivered through HTTP requests that trigger the plugin’s deserialization logic, such as during payment processing or order handling. Successful exploitation could lead to complete takeover of the affected WordPress site.