The vulnerability identified as CVE-2026-49777 in Product Slider Pro for WooCommerce is due to improper validation of specified quantity input (CWE-1284). This input validation flaw can be exploited remotely without authentication (AV:N/AC:L/PR:N/UI:N) and affects the product's security state (S:C) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vendor has applied a fix internally without releasing a new version, causing ambiguity about the patch status. Consequently, all existing versions are considered vulnerable. No patch or official remediation level has been published, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized code execution or malicious software implantation. The critical CVSS score of 10.0 reflects the potential for severe impact on confidentiality, integrity, and availability. Since no confirmed patched version is publicly available, users remain at risk until they can verify the presence of the vendor's fix.

Patch status is not yet confirmed—users cannot reliably determine if their installation includes the vendor's fix because it was applied without a new version release. It is recommended to contact ShapedPlugin, LLC directly for verification and guidance. Until an official patched version is published, treat all existing installations as vulnerable and consider applying additional protective controls such as input validation proxies or restricting access to the affected plugin where feasible.