The vulnerability CVE-2026-22333 affects the YITH WooCommerce Compare plugin by YITHEMES, specifically versions up to 3.6.0. It is caused by unsafe deserialization of untrusted data, enabling an attacker with high privileges to perform object injection attacks. This can result in full compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data. The attacker must have high privileges to exploit the vulnerability, but once exploited, the impact is severe across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to the plugin. Avoid using affected versions of YITH WooCommerce Compare if possible.