External risk intelligence

WooCommerce Vehicle Parts Finder Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-49380

This vulnerability exists in a WordPress plugin designed for WooCommerce. WordPress sites are commonly deployed as public-facing web applications, and plugins are integral components of these web interfaces, making the vulnerable code directly reachable via the public internet as part of the standard web application attack surface.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical deserialization vulnerability in the WooCommerce Vehicle Parts Finder plugin for WordPress, which could allow unauthorized code execution. The issue is accessible over the network and affects versions up to and including 3.7.

Untrusted data allows code injection.
Widely used platform, potential for broad impact.
Confirm plugin usage and assess exposure.

Attack Path

How an attacker could exploit the issue

A distant attacker could send specially crafted data to the WooCommerce Vehicle Parts Finder plugin, triggering a deserialization flaw. This flaw can then lead to object injection, potentially allowing the attacker to execute arbitrary code.

No user interaction required.
Triggered by specially crafted data input.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious objects into the system when the plugin is used, potentially leading to the execution of arbitrary code or unauthorized data access when supported by the advisory.

System data and service integrity.
Via deserialization of untrusted data.
Potential for full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WooCommerce plugin likely affects website owners and their technical support teams. The first practical step is to identify all instances of the affected plugin, determine their exposure and criticality, and assign an owner for remediation planning.

Website owners and technical support own the issue.
Verify plugin reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WooCommerce Vehicle Parts Finder plugin?

This is a WordPress plugin designed to add search and filtering functionality for automotive parts to an online store. It integrates directly with WooCommerce to help customers locate specific items like brakes or tires based on vehicle make, model, and year. It functions as an extension of the broader WordPress ecosystem, managing database queries and data processing for store inventory.

What does deserialization of untrusted data mean for CVE-2025-49380?

This vulnerability is classified as CWE-502, which occurs when an application takes data from an outside source and converts it into a complex programming object without verifying its safety. In this specific case, the plugin fails to validate incoming information, allowing an attacker to 'inject' their own malicious objects. This process can trick the software into performing unintended actions or running code the developer never authorized.

How can an attacker trigger this vulnerability?

The flaw is triggered when the plugin receives specially crafted, malicious data from an external source. Because this happens during the deserialization process, it does not require a legitimate user to log in, click a link, or perform any manual actions. The bug is only triggered by this specific type of malformed data input; standard traffic from typical store customers browsing or searching for parts does not activate the vulnerability.

Is my website at risk from this vulnerability?

If you use this plugin on a WordPress site connected to the internet, Halo Surface Signal identifies this as a relevant concern. Because plugins are core components of web interfaces, the vulnerable code is often directly reachable to anyone on the public web. If your WordPress instance is internet-facing, external attackers have a direct path to reach the plugin's input handling functions, making it a high-priority area to investigate.

What are the first steps to handle CVE-2025-49380?

Begin by auditing your WordPress environment to confirm if you have the WooCommerce Vehicle Parts Finder plugin installed and check if your version is 3.7 or older. Once you have located all instances, evaluate the business criticality of those specific sites to prioritize your work. Assign a team member to monitor the developer's official channels for a security update and plan to replace or update the software immediately once a patched version becomes available.

References

patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/vu…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.