CVE-2026-93651: WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
Affected Software
1 affected component
Minimum and Maximum Quantity for WooCommerce<=2.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/minimum-and-maximum-quantity-for-woocommerceto a version that resolves this vulnerability.Fixed in 2.1.3
Event History
Sep 30, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires author-level privileges, as indicated by the PR:H attack vector. It is not an unauthenticated attack.
2
Which plugin versions are affected?
The issue affects Minimum and Maximum Quantity for WooCommerce versions 2.1.2 and earlier.
3
What level of impact could successful exploitation have?
The CVSS vector indicates high impact to confidentiality, integrity, and availability. The reported weakness is PHP object injection.