CVE-2025-49380: WooCommerce Vehicle Parts Finder Flaw

CVE-2025-49380 Overview

CVE-2025-49380 is a PHP Object Injection vulnerability in the wpinstinct WooCommerce Vehicle Parts Finder plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 3.7. Unauthenticated attackers can trigger the deserialization path over the network without user interaction. Successful exploitation can lead to arbitrary object injection, which frequently escalates to remote code execution when suitable POP (Property-Oriented Programming) gadget chains exist in the WordPress core or other active plugins.

Critical Impact
Unauthenticated attackers can inject arbitrary PHP objects into WooCommerce storefronts running the vulnerable plugin, potentially leading to remote code execution, data theft, and full site compromise.

Affected Products

wpinstinct WooCommerce Vehicle Parts Finder plugin (woo-vehicle-parts-finder)
All versions from n/a through 3.7
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2025-10-22 - CVE-2025-49380 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49380

Vulnerability Analysis

The vulnerability is a classic PHP Object Injection issue. The plugin passes attacker-controlled input to PHP's unserialize() function without validating the source or contents of the serialized data. When PHP deserializes attacker-supplied data, it instantiates arbitrary classes and invokes their magic methods such as __wakeup(), __destruct(), and __toString().

On a typical WordPress installation, many classes with sensitive magic methods are loaded. Attackers chain these classes into a POP gadget chain to achieve file write, file read, SQL query execution, or command execution. The CVSS vector indicates the attack is executed remotely over the network with low complexity and no privileges or user interaction required.

Root Cause

The root cause is unsafe deserialization of untrusted input inside the woo-vehicle-parts-finder plugin. The plugin accepts serialized PHP data from a request parameter or stored value and passes it to unserialize() without integrity checks, allowlists, or use of safe alternatives such as json_decode(). This pattern is tracked as CWE-502: Deserialization of Untrusted Data.

Attack Vector

An unauthenticated attacker crafts a serialized PHP payload containing a POP gadget chain built from classes present in WordPress, WooCommerce, or other loaded plugins. The attacker submits this payload through a plugin endpoint that reaches the vulnerable unserialize() call. When PHP deserializes the payload, gadget methods execute, producing effects such as arbitrary file operations, database changes, or command execution under the web server user. Further technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-49380

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP markers such as O:, a:, or s: targeting plugin endpoints under /wp-content/plugins/woo-vehicle-parts-finder/.
Unexpected PHP files, webshells, or modified .php files under wp-content/uploads/ or plugin directories.
New or modified WordPress administrator accounts created without corresponding audit log entries.
Outbound network connections from the web server to unknown hosts following requests to plugin endpoints.

Detection Strategies

Inspect web server access logs for POST requests to plugin endpoints containing serialized PHP object patterns.
Deploy a Web Application Firewall (WAF) rule that blocks request parameters matching PHP serialization signatures targeting the vulnerable plugin path.
File integrity monitoring on the WordPress installation to identify unauthorized changes to core, plugin, or theme files.

Monitoring Recommendations

Alert on process creation by the web server user (www-data, apache, nginx) spawning shells or interpreters such as bash, sh, or python.
Monitor WordPress wp_users and wp_options tables for anomalous inserts or updates.
Track egress traffic from web-facing hosts to identify command-and-control callbacks following exploitation attempts.

How to Mitigate CVE-2025-49380

Immediate Actions Required

Identify all WordPress sites with woo-vehicle-parts-finder installed and confirm the installed version.
Deactivate and remove the plugin if it is not required, since no fixed version above 3.7 is referenced in the advisory.
Restrict administrative and plugin endpoints behind a WAF or IP allowlist until remediation is complete.
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API credentials stored in the database.

Patch Information

The advisory lists affected versions up to and including 3.7. Consult the Patchstack Vulnerability Report for the latest patch status and vendor guidance. Apply the vendor update as soon as a fixed release becomes available and validate the plugin version after deployment.

Workarounds

Uninstall the woo-vehicle-parts-finder plugin until a patched version is verified.
Deploy WAF signatures that block PHP serialization payloads on plugin endpoints.
Enforce least privilege on the web server process and disable PHP execution in writable directories such as wp-content/uploads/.

bash

# Example WAF rule (ModSecurity) blocking PHP serialized payloads to the vulnerable plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/woo-vehicle-parts-finder/" \
  "phase:2,chain,deny,status:403,id:1004938,msg:'Block PHP object injection attempt (CVE-2025-49380)'"
  SecRule ARGS|REQUEST_BODY "@rx O:[0-9]+:\"[a-zA-Z_\\\\]+\":[0-9]+:" \
    "t:none,t:urlDecodeUni"