The WooCommerce - Social Login plugin for WordPress is affected by a PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of untrusted data from the 'woo_slg_verify' parameter. This vulnerability exists in all versions up to and including 2.6.2. An unauthenticated attacker can inject a PHP object, but exploitation requires a POP chain, which is not present in the plugin alone. If a POP chain exists via other installed plugins or themes, the attacker could leverage this to perform destructive or unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, and full confidentiality, integrity, and availability impact.

Successful exploitation can lead to critical impacts including arbitrary code execution, deletion of files, and disclosure of sensitive data. The vulnerability is exploitable remotely without authentication. However, exploitation depends on the presence of a POP chain in other installed components, which is not included in the vulnerable plugin itself.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the WooCommerce - Social Login plugin or restricting access to the vulnerable parameter. Additionally, review and harden other installed plugins and themes to reduce the risk of a POP chain enabling exploitation.