The vulnerability is a PHP Object Injection flaw that occurs when custom role data is processed by the eCommerce Product Catalog plugin. An attacker can craft serialized objects that the plugin will unserialize, leading to arbitrary code execution. The impact includes potential data disclosure, unauthorized modification of site content or functionality, and disruption of service as the plugin’s core functionality can be hijacked to run attacker‑controlled code.

WordPress sites running the impleCode eCommerce Product Catalog plugin at version 3.6.0 or earlier are affected. The flaw exists in all versions up to and including 3.6.0; newer releases starting with 3.6.1 contain the patch. Administrators must verify that the plugin is not present or is updated accordingly.

The CVSS score of 7.2 indicates a high severity level for this exploitation, though the EPSS score is not available, leaving the actual likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog, but its nature allows an attacker to craft a payload that will be unserialized by the plugin, potentially achieving remote code execution. The attack vector appears to be through inputs that the plugin accepts for custom role management, which an authenticated user with sufficient permissions could manipulate. Users with administrative or equivalent privileges, or an attacker who gains such access, can exploit this flaw. The risk remains significant until the affected plugin is upgraded.