The vulnerability CVE-2025-49380 affects the WooCommerce Vehicle Parts Finder plugin by wpinstinct, specifically versions up to and including 3.7. It involves deserialization of untrusted data, which enables object injection attacks. This type of vulnerability can allow an attacker to execute arbitrary code or manipulate application behavior by injecting malicious serialized objects. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized code execution, data manipulation, and service disruption. The critical CVSS score reflects the high risk posed by this flaw, as it can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to it to mitigate potential exploitation. Monitor official wpinstinct communications for patch availability and apply updates promptly once released.