CVE-2026-105872

HighCVSS 7.2

Published: 09/10/2026(UTC)Updated: 11/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection. This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

Risk Assessment

An attacker can inject malicious PHP objects, potentially leading to code execution or other severe impacts within the WordPress application context.

Recommendation

Update the Product Configurator for WooCommerce plugin to a version newer than 1.7.5 or disable it if no fix is available.

Other vulnerabilities in Product Configurator for WooCommerce

CVE-2026-11568High
The Product Configurator for WooCommerce WordPress plugin before version 1.7.3 lacks authorization and post-status checks when returning WooCommerce product data via a public AJAX action. This allows unauthenticated users to retrieve data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft products by supplying the product ID, bypassing WordPress post-visibility controls.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS