Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization of untrusted data supplied via the import configuration feature without capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No POP chain is present within the vulnerable plugin itself, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow an attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-29 | 1 | General1 |
| 2026-06-29 | 1 | Disclosure1 |
New advisory to triage: CVE-2025-11993. The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to… Inventory first. Panic never helps.
Post summary
An advisory reports CVE-2025-11993 as a PHP Object Injection in the WooCommerce Infinite Scroll and Ajax Pagination plugin, but no exploits, patches, or active use are mentioned.
CVE-2025-11993 PHP Object Injection in WooCommerce Infinite Scroll and A... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-11993 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The text only references CVE-2025-11993 with a generic title and a link, but provides no details about exploitation, PoC, or patch information.