The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress suffers from a PHP Object Injection vulnerability (CWE-502) in all versions up to 1.8. This occurs because the 'import_settings' function deserializes untrusted data passed via the 'settings' parameter without verifying user capabilities. Attackers with at least Subscriber-level privileges can inject malicious PHP objects. Exploitation depends on the presence of a POP chain in other plugins or themes installed on the target system, which could enable destructive or unauthorized actions such as file deletion, data theft, or remote code execution.

Successful exploitation allows authenticated users with low privileges to perform PHP Object Injection, potentially leading to high-impact consequences including arbitrary file deletion, sensitive data exposure, and remote code execution. The impact is contingent on the presence of a POP chain in other installed components, which the vulnerable plugin does not provide itself. The CVSS score of 8.8 reflects the high confidentiality, integrity, and availability impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the import configuration feature to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor or security advisories to apply an official patch once available.