The CoDesigner – All in One Elementor WooCommerce Builder plugin for WordPress suffers from a PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of the recently_viewed_products cookie. This allows unauthenticated attackers to inject PHP objects. Although the plugin itself lacks a POP chain to enable direct exploitation, the presence of other plugins or themes with suitable gadget chains could enable attackers to perform destructive or unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code. The vulnerability affects all versions up to and including 4.4.1 and has a CVSS 3.1 base score of 9.0 (critical).

Successful exploitation could lead to full compromise of the affected WordPress site, including arbitrary code execution, data theft, and denial of service. The impact depends on the presence of additional plugins or themes that provide a POP chain necessary for exploitation. Without such chains, direct exploitation is not possible. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting the use of the recently_viewed_products cookie or removing the vulnerable plugin. Monitor vendor channels for updates and apply patches promptly once available.