EUVD-2026-31045
GHSA-r5mf-5vch-2vpf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconFingerprint WordPress plugins/themes
-
DeliveryIdentify available POP gadget chain
-
ExploitCraft serialized PHP object payload
-
InstallSend HTTP request with STYXKEY-BOOST_USER_LOCATION cookie
-
C2Trigger unserialize() in Boost plugin
-
ExecuteGadget chain executes attacker primitive
-
ImpactFile deletion, data exfiltration, or RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the Boost plugin (by PixelYourSite) installed and active at a version ≤ 2.0.3, AND that at least one other installed plugin or theme contains a usable PHP POP/gadget chain - the Boost plugin alone contains no gadget chain, so an isolated install is not directly exploitable for code execution, file deletion, or data theft. The attacker must be able to reach the site over HTTP/HTTPS and set the STYXKEY-BOOST_USER_LOCATION cookie on a request to any endpoint that triggers the vulnerable deserialization path; no authentication, no user interaction, and no privileges are required (CVSS PR:N/UI:N). Limiting factors: the dependency on a co-installed gadget chain, and any front-end WAF or reverse proxy that filters or normalizes cookies. |
| Impact | Signals are notably conflicting here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8 Critical) reflects worst-case impact assuming a usable POP chain exists, but the description itself states the vulnerability 'has no impact unless another plugin or theme containing a POP chain is installed' - meaning real-world severity is conditional on the target site's plugin/theme composition. WordPress sites routinely run 20+ plugins, and well-known gadget chains exist in popular components, so the conditional is frequently satisfied in practice. There is no public exploit identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was supplied in the input. Net assessment: treat as high-priority patching for any site running Boost ≤2.0.3, but expect targeted rather than mass exploitation given the gadget-chain dependency. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP request to any page of a target WordPress site running Boost ≤2.0.3 with a crafted STYXKEY-BOOST_USER_LOCATION cookie containing a serialized PHP object referencing a class from a co-installed plugin/theme with a known gadget chain. On deserialization, magic methods on the reconstructed object execute attacker-chosen primitives - for example, deleting arbitrary files via a __destruct gadget, exfiltrating wp-config.php via a file-read gadget, or achieving RCE through a chained call into a writable include. No public exploit code is identified at time of analysis, but cookie-driven PHP object injection is straightforward to weaponize once a target's plugin inventory is fingerprinted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
PHP Object Injection in the Boost plugin for WordPress (versions up to and including 2.0.3) allows unauthenticated remote attackers to inject arbitrary PHP objects via the STYXKEY-BOOST_USER_LOCATION cookie. The vulnerability stems from unsafe deserialization of attacker-controlled cookie data; while the plugin itself ships no usable POP (property-oriented programming) chain, exploitation becomes high-impact when any other installed plugin or theme provides one. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Released patched version not independently confirmed from the supplied references; administrators should upgrade Boost to the latest version released after 2.0.3 as published by PixelYourSite at https://www.pixelyoursite.com/boost-plugin and tracked by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/e391f560-2037-4180-a77e-1731524a318c?source=cve. As an interim compensating control where immediate upgrade is not feasible, deactivate the Boost plugin entirely (side effect: loss of plugin functionality), or deploy a WAF rule that strips or rejects requests containing the STYXKEY-BOOST_USER_LOCATION cookie (side effect: breaks geolocation features the plugin provides). Auditing and removing other plugins/themes that contain known PHP object injection gadget chains substantially reduces exploitability but does not eliminate the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Boost plugin is a PixelYourSite product (CPE: cpe:2.3:a:pixelyoursite:boost) used on WordPress sites for marketing/conversion enhancement. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes the value of the STYXKEY-BOOST_USER_LOCATION cookie into PHP's unserialize() (or equivalent) without validation, allowing attacker-controlled object graphs to be reconstructed in memory. In PHP, instantiating arbitrary classes can invoke magic methods (__wakeup, __destruct, __toString), which - when reachable application classes have side-effectful logic - can be chained into file writes, file reads, SQL operations, or RCE. This is the classic 'gadget chain' pattern familiar from other WordPress object injection bugs.
Know when Boost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Executive ViewAI
The Boost plugin for WordPress (versions ≤2.0.3) contains a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code on affected websites. Organizations using this plugin face immediate compromise risk, potentially affecting website availability, customer data, and operational continuity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy WAF rule to block/sanitize STYXKEY-BOOST_USER_LOCATION cookie; (2) Disable or uninstall Boost plugin until patch released; (3) Monitor vendor advisory channels and CISA KEV for patch notification; (4) Restrict additional plugin installations to minimize gadget chain availability; (5) Implement request logging and alerting for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Boost WordPress Plugin Injection Vulnerabilities
View all 2inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets re
Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for cont
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated a
Improper input type validation in Boost Serialization versions up to 1.91 allows remote attackers to send maliciously cr
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain i
Exploit-DB