CVE Intelligence
Analysis AI-assisted

CVE-2025-49380: wpinstinct WooCommerce Vehicle Parts Finder Deserialization Object Injection

CVE-2025-49380 is a critical deserialization of untrusted data flaw (CWE-502) in the WooCommerce Vehicle Parts Finder plugin by wpinstinct, which allows object injection. The CNA scored it 9.8 under CVSS 3.1, and the description covers versions from n/a through 3.7. The record shows no KEV listing and no fixed version, so administrators should verify their plugin status and reduce exposure.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a deserialization of untrusted data weakness (CWE-502) in the WooCommerce Vehicle Parts Finder plugin by wpinstinct, tracked as CVE-2025-49380. According to the description, the weakness allows object injection. The source of the record is the CNA audit@patchstack.com.

Impact

  • The CNA assigned a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges and no user interaction.
  • Object injection flaws can lead to unintended application behavior. The specific consequences in this plugin are not described in the record.

Affected products and versions

  • Product: WooCommerce Vehicle Parts Finder (woo-vehicle-parts-finder) by wpinstinct.
  • Affected range per the description: from n/a through 3.7 (inclusive).
  • The structured affected list in the record is empty, so the range comes only from the description text.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted for this analysis. The EPSS data in the record is a predicted probability and does not confirm observed activity.

Remediation and mitigation

  • The record lists no fixed version. The absence of fix data does not prove that no fix exists, so check the vendor or the plugin repository for updates.
  • If no fixed release is available and the plugin is not essential, consider deactivating or removing it.
  • Limit who can reach administrative and plugin functions, and keep WordPress, WooCommerce and other components up to date.
  • A web application firewall can serve as a temporary, generic layer while a fix is evaluated, but it should not be treated as a complete remedy.

Detection guidance

  • Review web server and application logs for unusual requests directed at the plugin.
  • Monitor for unexpected changes to plugin files, unfamiliar administrative accounts and unexpected scheduled tasks.
  • Inventory all sites where the plugin is installed and record the installed version of each.

Limitations of the available information

  • The record has no title, no structured affected or fixed version list, and no details beyond the CNA score.
  • The source status is recorded as Deferred. The only reference in the record is the Patchstack database entry, plus NVD and CVE.org record pages.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so the EPSS values should be interpreted with caution.

Frequently asked questions

What is CVE-2025-49380?

It is a deserialization of untrusted data weakness (CWE-502) in the WooCommerce Vehicle Parts Finder plugin by wpinstinct that allows object injection, as described in the record.

Which versions are affected?

The description says the affected range runs from n/a through 3.7. The structured affected list in the record is empty, so confirm your installed version directly.

Is this vulnerability known to be exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Check the vendor for an update. If no fix is available and the plugin is not essential, consider deactivating it and reducing access to its functions while monitoring logs.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.