CVE-2026-40725

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
Barn2 Media LtdWooCommerce Product Filters< 2.0.6

References

Timeline

Published
Jun 17, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-407268.2Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.CVE-2026-407277.7Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.CVE-2026-407284.3Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control SecuCVE-2026-407294.3Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access ControCVE-2026-40736.4The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and includinCVE-2026-407305.3Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly ConfiguredCVE-2026-407318.1Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.CVE-2026-407327.1Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.CVE-2026-407338.1Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.CVE-2026-407346.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-imCVE-2026-407358.1Unauthenticated PHP Object Injection in Reina <= 2.1 versions.CVE-2026-407368.1Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.
CVE-2026-40725: Critical severity, CVSS 9.8 | Vulnix