CVE-2025-1913 is a PHP Object Injection vulnerability (CWE-502) in the Product Import Export for WooCommerce – Import Export Product CSV Suite WordPress plugin. It arises from unsafe deserialization of untrusted input passed via the 'form_data' parameter. The vulnerability affects all versions up to 2.5.0 and requires attacker authentication with administrator privileges. No proof-of-concept (POP) chain is included in the vulnerable plugin itself, so exploitation depends on the presence of additional plugins or themes that provide a suitable POP chain to enable malicious actions such as arbitrary file deletion, sensitive data access, or remote code execution.

If exploited in an environment where a POP chain exists in other installed plugins or themes, an authenticated administrator attacker could perform high-impact actions including deleting arbitrary files, retrieving sensitive information, or executing arbitrary code. Without such a POP chain, the vulnerability alone does not lead to impact. The CVSS 3.1 base score is 7.2 (high), reflecting the potential severity when combined with other components.

No official patch or fix is currently available for this vulnerability. Since exploitation requires administrator access and the presence of a POP chain in other software, site administrators should limit plugin and theme installations to trusted sources and monitor for updates from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restricting administrator access and minimizing installed plugins/themes that could provide a POP chain can reduce risk.