CVE-2025-49417: Bestwpdeveloper Woocommerce Product Multi-Action

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through <= 1.3.

Affected products

• Bestwpdeveloper Woocommerce Product Multi-Action: up to and including 1.3

Published 2025-07-04. Last modified 2026-06-17.