What is the CVSS score of CVE-2026-7637?

CVE-2026-7637 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Boost WordPress Plugin are affected by CVE-2026-7637?

The Boost plugin for WordPress (versions ≤2.0.3) contains a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code on affected websites.

How to fix or mitigate CVE-2026-7637?

24 hours: Identify all WordPress installations running Boost ≤2.0.3 and document installed plugins/themes. 7 days: Implement WAF rules to block the STYXKEY-BOOST_USER_LOCATION cookie or disable Boost plugin pending patch availability. 30 days: Upgrade to patched Boost version when vendor releases; conduct full plugin inventory and establish vendor security review process.

Boost WordPress Plugin CVE-2026-7637

EUVD-2026-31045 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-20 Wordfence

GHSA-r5mf-5vch-2vpf

Deserialization PHP Information Disclosure WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:00 vuln.today

DescriptionCVE.org

The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

AnalysisAI

PHP Object Injection in the Boost plugin for WordPress (versions up to and including 2.0.3) allows unauthenticated remote attackers to inject arbitrary PHP objects via the STYXKEY-BOOST_USER_LOCATION cookie. The vulnerability stems from unsafe deserialization of attacker-controlled cookie data; while the plugin itself ships no usable POP (property-oriented programming) chain, exploitation becomes high-impact when any other installed plugin or theme provides one. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The Boost plugin is a PixelYourSite product (CPE: cpe:2.3:a:pixelyoursite:boost) used on WordPress sites for marketing/conversion enhancement. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes the value of the STYXKEY-BOOST_USER_LOCATION cookie into PHP's unserialize() (or equivalent) without validation, allowing attacker-controlled object graphs to be reconstructed in memory. In PHP, instantiating arbitrary classes can invoke magic methods (__wakeup, __destruct, __toString), which - when reachable application classes have side-effectful logic - can be chained into file writes, file reads, SQL operations, or RCE. This is the classic 'gadget chain' pattern familiar from other WordPress object injection bugs.

RemediationAI

Released patched version not independently confirmed from the supplied references; administrators should upgrade Boost to the latest version released after 2.0.3 as published by PixelYourSite at https://www.pixelyoursite.com/boost-plugin and tracked by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/e391f560-2037-4180-a77e-1731524a318c?source=cve. As an interim compensating control where immediate upgrade is not feasible, deactivate the Boost plugin entirely (side effect: loss of plugin functionality), or deploy a WAF rule that strips or rejects requests containing the STYXKEY-BOOST_USER_LOCATION cookie (side effect: breaks geolocation features the plugin provides). Auditing and removing other plugins/themes that contain known PHP object injection gadget chains substantially reduces exploitability but does not eliminate the underlying flaw.