CVE-2026-27045: 
WordPress vulnerability analysis and mitigation

CVE-2026-27045 is a PHP Object Injection vulnerability (Deserialization of Untrusted Data) in the WooCommerce Infinite Scroll WordPress plugin by sbthemes. It affects all versions through 1.6.2 and was reported by researcher Phat RiO on December 15, 2025, with public disclosure on March 16–25, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), requiring only low-level authenticated access to exploit (Patchstack, Feedly).

The vulnerability is classified as CWE-502: Deserialization of Untrusted Data, enabling PHP Object Injection (CAPEC-586). An attacker with Subscriber-level (low-privilege) authentication can supply crafted serialized PHP data to the plugin, which is deserialized without proper validation. If a suitable PHP Object Property (POP) chain exists within the WordPress/WooCommerce environment, this can be leveraged to achieve arbitrary code execution, SQL injection, path traversal, or denial of service (Patchstack).

Successful exploitation could allow an authenticated attacker to achieve arbitrary code execution, unauthorized data access, modification of WooCommerce data, SQL injection, and path traversal — resulting in full compromise of confidentiality, integrity, and availability of the affected WordPress site. The impact is contingent on the presence of a usable POP chain in the target environment, which is commonly available in WordPress installations with popular plugins. Lateral movement within the hosting environment and theft of sensitive customer or payment data stored in WooCommerce are realistic outcomes (Patchstack, Feedly).

As of the time of disclosure, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class (CVSS 8.8, low-privilege PHP Object Injection) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the WooCommerce Infinite Scroll plugin (slug: sb-woocommerce-infinite-scroll) version ≤ 1.6.2 using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (e.g., via open registration or compromised credentials).
3. Identify the vulnerable deserialization endpoint: Analyze the plugin's source code to locate the PHP function that deserializes user-supplied input without sanitization.
4. Identify a POP chain: Enumerate installed plugins and themes on the target to find a usable PHP Object Property chain (e.g., via tools like PHPGGC) that can be triggered upon deserialization.
5. Craft malicious payload: Generate a serialized PHP object payload using the identified POP chain (e.g., php -r "echo serialize(new GadgetClass());" or using PHPGGC).
6. Submit payload: Send the crafted serialized payload to the vulnerable plugin endpoint via an authenticated HTTP request.
7. Achieve objective: Depending on the POP chain, trigger arbitrary code execution, file write, SQL injection, or other impacts on the server (Patchstack).

• Network: Authenticated HTTP requests to WooCommerce Infinite Scroll plugin endpoints containing serialized PHP data (e.g., strings beginning with O:, a:, or s: in POST body or parameters).
• Logs: WordPress/Apache/Nginx access logs showing unusual POST requests from Subscriber-level accounts to plugin-related endpoints; PHP error logs referencing unexpected class instantiation or unserialize() calls.
• File System: Unexpected PHP files or web shells created in the WordPress uploads directory or plugin directories; modified plugin files with injected code.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) indicating command execution via deserialization.
• Database: Unexpected changes to WooCommerce orders, user roles, or WordPress options table entries (e.g., wp_options) that could indicate SQL injection or data manipulation.

As of the disclosure date, no official patch is available for the WooCommerce Infinite Scroll plugin (versions ≤ 1.6.2). Recommended actions include:

• Disable or remove the plugin if it is not actively required.
• Restrict user registration to prevent unauthorized Subscriber-level accounts.
• Deploy a WAF rule: Patchstack has issued a virtual patch/mitigation rule to block exploitation attempts for subscribers of its service.
• Implement WAF rules to detect and block serialized PHP object payloads in HTTP requests.
• Monitor WooCommerce and WordPress logs for suspicious deserialization activity.
• Update immediately once an official patched version is released by sbthemes (Patchstack).

Patchstack, which discovered and disclosed the vulnerability (credited to researcher Phat RiO), classified it as High Priority and noted that vulnerabilities of this type are commonly used in mass-exploit campaigns against WordPress sites. Wordfence included this vulnerability in its weekly WordPress vulnerability report for the week of March 16–22, 2026. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.