Read the docs
TI-2026-69997 Aliases CVE-2026-105872GHSA-7mrq-mrvf-rm6g

PHP object injection in Product Configurator for WooCommerce plugin

Priority LOW 33CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

The WordPress Product Configurator for WooCommerce plugin by mklacroix, from n/a through 1.7.5, deserializes untrusted data (CWE-502), which allows PHP object injection. A remote attacker with high privileges can inject objects, which can compromise confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mklacroixProduct Configurator for WooCommerceup to 1.7.5—No fix listedCNA
  • Product Configurator for WooCommerce Vendormklacroix Affected up to 1.7.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Product Configurator for WooCommerce.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-105872
  2. 2026-10-09 Alias added: GHSA-7mrq-mrvf-rm6g
  3. 2026-10-11 CISA SSVC decision points changed
  4. 2026-10-11 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2025-34437 WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences