CVE-2025-0956

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0956", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-31T20:14:55.535Z", "datePublished": "2025-03-05T09:21:43.592Z", "dateUpdated": "2026-04-08T16:33:45.919Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:45.919Z"}, "affected": [{"vendor": "FantasticPlugins", "product": "WooCommerce Recover Abandoned Cart", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "24.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "title": "WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/067c974c-b3bb-4f06-8f7c-3963112c40d2?source=cve"}, {"url": "https://codecanyon.net/item/woocommerce-recover-abandoned-cart/7715167"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "timeline": [{"time": "2025-03-04T21:10:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-05T15:01:00.738084Z", "id": "CVE-2025-0956", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T15:01:42.954Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-05T15:01:00.738084Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T15:01:35.981Z"}}], "cna": {"title": "WooCommerce Recover Abandoned Cart <= 24.3.0 - Unauthenticated PHP Object Injection", "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "FantasticPlugins", "product": "WooCommerce Recover Abandoned Cart", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "24.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-04T21:10:26.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/067c974c-b3bb-4f06-8f7c-3963112c40d2?source=cve"}, {"url": "https://codecanyon.net/item/woocommerce-recover-abandoned-cart/7715167"}], "descriptions": [{"lang": "en", "value": "The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-05T09:21:43.592Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0956", "state": "PUBLISHED", "dateUpdated": "2025-03-05T15:01:42.954Z", "dateReserved": "2025-01-31T20:14:55.535Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-05T09:21:43.592Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WooCommerce Recover Abandoned Cart", "vendor": "FantasticPlugins", "versions": [{"lessThanOrEqual": "24.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}, {"lang": "es", "value": "El complemento WooCommerce Recover Abandoned Cart para WordPress es vulnerable a la inyecci\u00f3n de objetos PHP en todas las versiones hasta la 24.3.0 incluida, a trav\u00e9s de la deserializaci\u00f3n de la entrada no confiable de la cookie 'raccookie_guest_email'. Esto hace posible que atacantes no autenticados inyecten un objeto PHP. No hay ninguna cadena POP conocida presente en el software vulnerable, lo que significa que esta vulnerabilidad no tiene impacto a menos que se instale en el sitio otro complemento o tema que contenga una cadena POP. Si hay una cadena POP presente a trav\u00e9s de un complemento o tema adicional instalado en el sistema de destino, puede permitir al atacante realizar acciones como eliminar archivos arbitrarios, recuperar datos confidenciales o ejecutar c\u00f3digo seg\u00fan la cadena POP presente."}], "id": "CVE-2025-0956", "lastModified": "2026-06-17T08:27:26.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0956", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-05T15:01:00.738084Z", "version": "2.0.3"}}]}, "published": "2025-03-05T10:15:19.480", "references": [{"source": "security@wordfence.com", "url": "https://codecanyon.net/item/woocommerce-recover-abandoned-cart/7715167"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/067c974c-b3bb-4f06-8f7c-3963112c40d2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:32:11.386634+00:00", "value": {"mitigation_remediation": ["Upgrade the WooCommerce Recover Abandoned Cart plugin to version 24.4.1 or later", "Remove or update any other plugins or themes that may contain PHP Object Poisoning chains", "If an immediate upgrade is not feasible, uninstall or disable the vulnerable plugin to block the injection vector"], "summary": {"action": "Upgrade Plugin", "impact": "Potential code execution via PHP Object Injection"}, "threat_synthesis": {"affected_systems": "The affected product is the WooCommerce Recover Abandoned Cart plugin distributed by FantasticPlugins. All releases up to and including version 24.4.0 are vulnerable. The plugin runs on WordPress installations where it is installed and activated.", "description_and_impact": "The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 24.4.0 because it unserializes untrusted input from the raccookie_guest_email cookie. An unauthenticated attacker can inject a PHP object, but the vulnerability alone does not provide a direct attack vector; it requires a second\u2011party plugin or theme that contains a PHP Object Poisoning (POP) chain to succeed. If such a chain is present, the attacker could delete arbitrary files, retrieve sensitive data, or execute code, thereby compromising confidentiality, integrity, and potentially availability of the WordPress site.", "risk_and_exploitability": "The CVSS score of 8.1 reflects a high severity with medium to high exploitable impact when a POP chain exists. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a malicious raccookie_guest_email cookie and induce its use, typically by directing a visitor\u2019s browser to the site or forging requests. Exploitation is limited to sites that harbor additional vulnerable code; for sites without such code the risk remains theoretical."}}}}, "created": "2026-04-28T03:45:20.278198+00:00", "updated": "2026-04-28T03:45:20.278211+00:00", "vendors": []}