This vulnerability (CVE-2026-40725) affects WooCommerce Product Filters plugin versions before 2.0.6 by allowing unauthenticated PHP Object Injection through unsafe deserialization of untrusted data (CWE-502). This can lead to remote code execution without requiring user authentication. The CVSS 3.1 score of 9.8 reflects the critical nature of this flaw with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability can result in complete compromise of the affected system, including unauthorized code execution, data disclosure, data modification, and service disruption. Because the attack requires no authentication and can be performed remotely, the risk to affected installations is very high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to it to trusted users only. Monitor Barn2 Media Ltd's official channels for updates and apply patches promptly once released.