CVE-2025-11993: WooCommerce Infinite Scroll Plugin PHP Object Injection – HIGH Severity

Technical summary

CVE-2025-11993 is a PHP Object Injection vulnerability (CWE-502) in the WooCommerce Infinite Scroll and Ajax Pagination plugin. The 'import_settings' function deserializes untrusted user input from the 'settings' parameter without performing proper validation or capability verification. An authenticated user with Subscriber role or higher can craft a malicious serialized object payload and submit it via the import configuration mechanism. While no gadget chain exists within the vulnerable plugin itself, a successful attack depends on the presence of exploitable POP (Property-Oriented Programming) chains in companion plugins or themes. CVSS 3.1 score of 8.8 (HIGH) reflects the significant impact potential: confidentiality (C:H), integrity (I:H), and availability (A:H) are all compromised under the assumption that a suitable gadget chain is available.

Business impact

For WordPress sites using this plugin, the risk is two-fold: immediate and conditional. Any site running versions ≤1.8 is immediately vulnerable to object injection from low-privileged authenticated accounts, which significantly expands the attack surface beyond typical admin-only compromise scenarios. If the site also runs vulnerable companion plugins with accessible gadget chains, attackers could achieve arbitrary file deletion (data loss), unauthorized access to sensitive information, or remote code execution. The combined effect could lead to site defacement, data breaches, customer information theft, or complete infrastructure compromise. Organizations relying on this plugin for pagination functionality should prioritize assessment and remediation.

Affected systems

The WooCommerce Infinite Scroll and Ajax Pagination plugin versions up to and including 1.8 are vulnerable. Any WordPress installation running this plugin is at risk, particularly those where Subscriber accounts are active or provisioned. The exploitability tier depends on whether the site has installed additional plugins or themes containing exploitable gadget chains; however, given the large WordPress ecosystem, most affected sites should assume some risk.

Exploitability

Exploitability is high in practice. The vulnerability requires only Subscriber-level authentication, a role commonly granted to users, reducing the barrier to exploitation. An attacker with such access can immediately trigger object injection without user interaction or special conditions. However, achieving high-impact outcomes (code execution, data theft, file deletion) is contingent on the availability of a gadget chain in another plugin or theme. This multi-dependency aspect does not reduce the severity of the underlying vulnerability, but it does mean that impact varies by deployment. Organizations should assume that if their WordPress ecosystem includes any plugins or themes with known gadget chains, this vulnerability becomes a direct path to compromise.

Remediation

Update the WooCommerce Infinite Scroll and Ajax Pagination plugin to a patched version beyond 1.8. Verify the patched version against the official WooCommerce plugin repository or the vendor's security advisory. Additionally, review all installed plugins and themes for known POP chains or deserialization gadgets, and update or remove those with unpatched vulnerabilities. Implement principle of least privilege: audit WordPress user roles and remove Subscriber access for users who do not require it. Consider disabling the import settings feature if it is not in active use.

Patch guidance

Check the official WooCommerce plugin repository for the latest version of WooCommerce Infinite Scroll and Ajax Pagination and apply it immediately. The patch should address deserialization validation in the import_settings function. Verify the applied version is greater than 1.8 by navigating to Plugins in the WordPress admin dashboard. After patching, conduct a full plugin audit to identify and update any companion plugins or themes that may harbor gadget chains. Test the patch in a staging environment before production deployment to ensure no regression in pagination or import functionality.

Detection guidance

Monitor WordPress audit logs and security plugins (such as Wordfence or Sucuri) for suspicious patterns: authenticated requests to the plugin's import settings endpoint from unusual user roles or IP addresses, serialized object payloads in POST parameters, or rapid repeated attempts to trigger import. Look for PHP errors or warnings related to object unserialization in error logs. Review user accounts with Subscriber or higher role for unexpected creation or privilege escalation. Implement Web Application Firewall (WAF) rules to detect serialized PHP objects in request parameters, particularly those targeting WooCommerce plugin functions. Increase logging verbosity for authenticated user actions on the target site.

Why prioritize this

This vulnerability warrants immediate prioritization due to its HIGH CVSS score (8.8), the low barrier to exploitation (Subscriber access), and the broad attack surface created by potential gadget chains in the wider WordPress ecosystem. Unlike vulnerabilities requiring admin access or user interaction, this flaw can be exploited by any authenticated user with minimal friction. The conditional nature of the full impact (code execution) should not be mistaken for low priority; even file deletion or data exfiltration alone represent significant business and compliance risks. Organizations running this plugin should treat patching as urgent.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network Attack Vector (AV:N), indicating remote exploitability; Low Attack Complexity (AC:L), meaning no special conditions or timing are required; Low Privileges Required (PR:L), indicating an authenticated Subscriber account is sufficient; and no User Interaction (UI:N). The impact assessment (C:H, I:H, A:H) assumes that a gadget chain is present on the target system, which is a reasonable assumption given the prevalence of plugins with exploitable chains in the WordPress ecosystem. The score appropriately captures the severity of object injection combined with widespread plugin availability.

Frequently asked questions