High · 7.2 CVE-2026-93771 EUVD-2026-89829GHSA-78c2-4847-384p

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: WPFactory Product: Cost of Goods for WooCommerce Category: Web / CMS

Description

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

Affected products

Vendor	Product	Affected	Fixed
WPFactory	Cost of Goods for WooCommerce	≤ 3.5.2	—

References

https://patchstack.com/database/wordpress/plugin/cost-of-goods-for-woocommerce/vulnerability/wordpress-cost-of-goods-for-woocommerce-plugin-3-5-2-php-object-injection-vulnerability?_s_id=cve vdb-entry