WooCommerce Product Filters: unauthenticated PHP Object Injection (CVE-2026-40725)
NVD has published CVE-2026-40725, a PHP Object Injection vulnerability in the WooCommerce Product Filters WordPress plugin. It can be reached without authentication and has a CVSS score of 9.8.
Checked in Shield: no
Who is affected
WordPress sites running the WooCommerce Product Filters plugin in versions below 2.0.6.
How to check
In the WordPress admin, open the Plugins page and look at the installed version of WooCommerce Product Filters. If it is below 2.0.6, the site is in the affected range.
How to fix
Going by the record's wording ("< 2.0.6"), version 2.0.6 is the fixed one. Update the plugin to 2.0.6 or later; if you cannot update, deactivate it for now.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation details and whether attacks are occurring are not disclosed yet; source: NVD (CVE-2026-40725).
