CVE-2026-105872: WooCommerce Product Configurator Deserialization

CVE-2026-105872 Overview

CVE-2026-105872 is a PHP Object Injection vulnerability in the mklacroix Product Configurator for WooCommerce plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions from n/a through 1.7.5. An authenticated attacker with high privileges can inject arbitrary PHP objects into the application. Successful exploitation can compromise confidentiality, integrity, and availability of the WooCommerce site.

Critical Impact
Attackers with high-privilege access can trigger PHP object injection to execute arbitrary code, modify data, or disrupt the WooCommerce storefront.

Affected Products

mklacroix Product Configurator for WooCommerce (product-configurator-for-woocommerce)
All versions up to and including 1.7.5
WordPress sites running WooCommerce with the vulnerable plugin

Discovery Timeline

2026-10-09 - CVE-2026-105872 published to NVD
2026-10-11 - Last updated in NVD database

Technical Details for CVE-2026-105872

Vulnerability Analysis

The Product Configurator for WooCommerce plugin passes attacker-controllable input into a PHP deserialization routine without validation. When PHP processes a serialized payload, it instantiates objects and triggers magic methods such as __wakeup() and __destruct(). If a suitable gadget chain exists in the WordPress core, WooCommerce, or any installed plugin, deserialization leads to arbitrary code execution, file writes, or data tampering.

The attack requires authentication with elevated privileges but no user interaction. Because the plugin runs within the WordPress request context, successful exploitation inherits the privileges of the PHP process, typically the web server user.

Root Cause

The root cause is the use of unserialize() or an equivalent deserialization sink on data that originates from a user-controllable source. The plugin does not restrict allowed classes and does not validate the payload structure before deserialization. This matches the [CWE-502] weakness pattern seen across many WordPress plugin vulnerabilities.

Attack Vector

An authenticated administrator-level or similarly privileged user submits a crafted serialized PHP payload to a vulnerable plugin endpoint over the network. The plugin deserializes the payload during request handling. Object instantiation then triggers gadget chains available in the WordPress runtime. Technical specifics are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-105872

Indicators of Compromise

Unexpected POST requests to Product Configurator endpoints containing serialized PHP strings beginning with O:, a:, or s:.
New or modified PHP files in wp-content/uploads/ or plugin directories after plugin interaction by a privileged user.
Outbound network connections from the PHP worker process to unfamiliar hosts following administrative plugin requests.

Detection Strategies

Inspect web server and WordPress access logs for requests to product-configurator-for-woocommerce routes carrying serialized object payloads.
Deploy a Web Application Firewall rule that flags request bodies matching PHP serialization patterns such as O:\d+:"[A-Za-z_]+".
Enable WordPress audit logging to correlate privileged account activity with plugin administrative actions.

Monitoring Recommendations

Monitor privileged WordPress accounts for anomalous session activity, geolocation, or user-agent changes.
Alert on PHP process spawning shell interpreters such as sh, bash, or python from the web server user context.
Baseline file integrity of plugin directories and alert on modifications outside of patch windows.

How to Mitigate CVE-2026-105872

Immediate Actions Required

Identify all WordPress sites running Product Configurator for WooCommerce version 1.7.5 or earlier.
Temporarily deactivate the plugin on affected sites until a patched release is installed.
Rotate credentials for any administrator or shop manager accounts that could reach the vulnerable endpoint.

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack lists versions through 1.7.5 as affected. Review the Patchstack Vulnerability Report for the latest fixed version information and update immediately once a patched release is available.

Workarounds

Restrict access to WordPress administrative paths using IP allowlists or VPN enforcement.
Enforce multi-factor authentication for all administrator and shop manager accounts.
Apply a WAF virtual patch that blocks requests containing PHP serialized object markers to the plugin endpoints.

bash

# Example ModSecurity rule to block serialized PHP objects on plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/product-configurator-for-woocommerce/" \
  "chain,id:1050001,phase:2,deny,status:403,log,msg:'Blocked PHP object injection attempt (CVE-2026-105872)'"
  SecRule REQUEST_BODY "@rx O:\d+:\"[A-Za-z_\\\\]+\"" "t:none"