PHP Object Injection in WooCommerce Pagination Plugin

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization of untrusted data supplied via the import configuration feature without capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No POP chain is present within the vulnerable plugin itself, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow an attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WooCommerce Infinite Scroll and Ajax Pagination plugin contains a critical PHP Object Injection vulnerability (CWE-502) in its import_settings function. Attackers with subscriber-level access can inject malicious serialized PHP objects through the settings parameter, bypassing capability checks entirely. This vulnerability affects all versions up to 1.8 and impacts any WordPress site using this plugin, potentially allowing attackers to manipulate application logic, access sensitive data, or establish persistence—even without an explicit POP chain, as gadget chains may exist in loaded WordPress or plugin classes.

Casky's 419 mapped security skills detect the attack patterns underlying this vulnerability by analyzing initial access (TA0001) through authenticated user enumeration, execution (TA0043) through deserialization gadget detection and PHP object instantiation, and persistence (TA0002) mechanisms. Practitioners using Casky would identify suspicious import_settings function calls with serialized object payloads, detect capability bypass attempts from low-privilege accounts accessing administrative functions, and recognize unusual class instantiation patterns that indicate object injection exploitation. The extended reasoning capabilities enable detection of indirect attack chains where serialized data flows through import handlers, highlighting the gap between permission checks at the UI level and the actual backend deserialization processing.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-11993.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2025-11993

Casky has 419 skills that investigate the attack patterns behind CVE-2025-11993. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn