The Custom Product Tabs for WooCommerce plugin suffers from a PHP Object Injection vulnerability due to unsafe deserialization of the 'yikes_woo_products_tabs' post meta parameter. This vulnerability affects all versions up to and including 1.8.5. Attackers with Shop Manager or higher privileges can inject malicious PHP objects. Although the plugin does not contain a known POP chain, the presence of other plugins or themes with exploitable gadget chains could enable severe impacts such as arbitrary file deletion, sensitive data retrieval, or remote code execution. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated users with Shop Manager-level access or above to inject PHP objects via deserialization, which could lead to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain exists in the environment. This elevates the risk of significant compromise of the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Shop Manager and higher privileges to trusted users only and consider disabling or removing the vulnerable plugin. Monitor vendor channels for updates and apply any official patches promptly once available.