This vulnerability (CVE-2026-93771) is a PHP Object Injection flaw in the Cost of Goods for WooCommerce plugin by WPFactory, present in versions up to 3.5.2. It stems from deserialization of untrusted data (CWE-502), allowing an attacker with shop manager privileges to inject malicious PHP objects. The CVSS 3.1 score is 7.2, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

An attacker with shop manager privileges can exploit this vulnerability to execute arbitrary PHP code or manipulate application logic, potentially leading to full system compromise including data theft, data modification, or denial of service.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to object deserialization.