CVE-2025-0956: WooCommerce Recover Abandoned Cart <= 24.3.0 - Unauthenticated PHP Object Injection
First published: Wed Mar 05 2025(Updated: )
The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Recover Abandoned Cart for WooCommerce | <=24.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0956?
The severity of CVE-2025-0956 is considered critical due to the potential for unauthorized remote code execution.
How do I fix CVE-2025-0956?
To fix CVE-2025-0956, update the WooCommerce Recover Abandoned Cart plugin to version 24.3.1 or later.
Who is affected by CVE-2025-0956?
Users of the WooCommerce Recover Abandoned Cart plugin for WordPress in versions up to and including 24.3.0 are affected by CVE-2025-0956.
What exploit can be performed due to CVE-2025-0956?
CVE-2025-0956 allows unauthenticated attackers to exploit the PHP Object Injection vulnerability through manipulated cookies.
When was CVE-2025-0956 published?
CVE-2025-0956 was published as part of ongoing security advisories to address vulnerabilities in widely used plugins.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/references
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/severity
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/woocommerce
- canonical/wordpress recover abandoned cart for woocommerce