The vulnerability was only present when WooCommerce’s “PayPal Identity Token” option is set.
Official description: Fix – Switch to JSON to avoid unserializing untrusted data when handling responses from PayPal.
This vulnerability affects the following application versions:
- WooCommerce 2.3.0
- WooCommerce 2.3.0-RC1
- WooCommerce 2.3.1
- WooCommerce 2.3.2
- WooCommerce 2.3.3
- WooCommerce 2.3.4
- WooCommerce 2.3.5
- WooCommerce 2.3.6
- WooCommerce 2.3.7
- WooCommerce 2.3.8
- WooCommerce 2.3.9
- WooCommerce 2.3.10