High · 7.2 CVE-2026-96344 EUVD-2026-89857GHSA-55c4-c658-wp4q

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: impleCode Product: eCommerce Product Catalog

Description

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

Affected products

Vendor	Product	Affected	Fixed
impleCode	eCommerce Product Catalog	≤ 3.6.0	—

References

https://patchstack.com/database/wordpress/plugin/ecommerce-product-catalog/vulnerability/wordpress-ecommerce-product-catalog-plugin-3-6-0-php-object-injection-vulnerability?_s_id=cve vdb-entry