CVE-2026-93771: WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
Affected Software
1 affected component
Barn2 Plugins Cost of Goods for WooCommerce<=3.5.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Cost of Goods for WooCommerceto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Sep 30, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
Exploitation requires high privileges. The issue is identified as affecting Shop manager access, so unauthenticated visitors are not the described threat actor.
2
Does exploitation require user interaction?
No user interaction is required. The CVSS vector indicates network access and low attack complexity once the attacker has the required privileges.
3
What is the potential impact if exploited?
The vulnerability is rated high severity and can have high impact on confidentiality, integrity, and availability.