The Ultimate Store Kit Elementor Addons, WooCommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, and WooCommerce Slider plugin is vulnerable to PHP Object Injection through unsafe deserialization of the _ultimate_store_kit_compare_products cookie. This vulnerability affects versions up to and including 1.6.4. The flaw allows an unauthenticated attacker to inject a PHP object. Although the vulnerable plugin itself does not contain a POP chain, the presence of additional plugins or themes that provide a POP chain could enable an attacker to delete arbitrary files, retrieve sensitive information, or execute arbitrary code on the target system.

Successful exploitation can lead to complete compromise of the affected system, including arbitrary code execution, data disclosure, and file deletion. The vulnerability is exploitable remotely without authentication, increasing its risk. However, exploitation depends on the presence of a POP chain in other installed components, which is not present in the vulnerable plugin alone.

No official patch or remediation has been published by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the affected plugin or restricting access to the vulnerable functionality. Monitor vendor channels for updates and apply patches promptly once released.