This vulnerability in the Multiple Shipping And Billing Address For Woocommerce plugin allows an attacker to exploit deserialization of untrusted data, resulting in object injection. This can lead to remote code execution or other severe impacts due to the nature of object injection attacks. The affected versions are from initial releases up to 1.5. The CVSS 3.1 vector indicates the attack can be performed remotely without authentication or user interaction, with critical impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code, compromise data confidentiality, integrity, and availability within the affected system. This poses a critical risk to systems using the vulnerable plugin, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider disabling or removing the vulnerable plugin to mitigate risk.