CVE-2026-105872: WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
product-configurator-for-woocommerceto a version that resolves this vulnerability.Fixed in 1.7.6
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The published vector indicates that an attacker needs high privileges. Exploitation is network-accessible, has low attack complexity, and does not require user interaction.
How can I determine whether my site is affected?
Check whether mklacroix Product Configurator for WooCommerce is installed and identify its version. The issue affects versions through 1.7.5; no unaffected fixed version is provided in the available data.
What is the potential impact if the vulnerability is exploited?
The published severity vector rates confidentiality, integrity, and availability impact as high. The vulnerability is classified as PHP object injection through deserialization of untrusted data.