CVE-2025-49887 is a critical code injection vulnerability in the WPFactory Product XML Feed Manager for WooCommerce plugin (versions up to 2.9.3). The flaw allows remote attackers to perform remote code inclusion due to improper control over code generation. This vulnerability can be exploited remotely without user interaction and requires low privileges, resulting in a complete system compromise. The CVSS v3.1 base score is 9.9, reflecting its critical impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected system, potentially leading to full compromise of the WooCommerce environment and underlying server. This includes unauthorized access, data manipulation, and service disruption. The critical CVSS score of 9.9 reflects the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor WPFactory and WooCommerce vendor channels for updates and apply patches promptly once available.