The CoinPayments.net Payment Gateway for WooCommerce plugin versions up to 1.0.17 contain a deserialization of untrusted data vulnerability that permits object injection attacks. This vulnerability can be exploited remotely without authentication or user interaction, potentially allowing attackers to execute arbitrary code or disrupt service. The vulnerability is classified as critical with a CVSS 3.1 base score of 9.8, reflecting its high impact on confidentiality, integrity, and availability. No official patch or fix has been disclosed yet, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including unauthorized code execution, data manipulation, and denial of service. The vulnerability affects the confidentiality, integrity, and availability of the system. There are no known exploits in the wild currently, but the high CVSS score indicates a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin to prevent exploitation. Monitor official CoinPayments communications for updates on fixes or mitigations.