The YITH WooCommerce Compare plugin for WordPress has a flaw that could allow unauthenticated attackers to inject malicious code into the plugin. If the plugin is on an older version (up to and including 2.0.9) attackers can inject a so-called “PHP Object” into the plugin through the ‘yith_woocompare_list’ cookie. This malicious code can allow the attacker to do anything from seeing private information to changing how the plugin functions. It has been confirmed that this vulnerability allows attackers to execute any code they want.