What is the CVSS score of CVE-2026-84099?

CVE-2026-84099 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of wpstorecart are affected by CVE-2026-84099?

The wpstorecart WordPress plugin (versions through 5.0.7) contains an unauthenticated object injection vulnerability that could enable remote code execution if a suitable exploit gadget chain exists…

How to fix or mitigate CVE-2026-84099?

Within 24 hours: immediately disable the wpstorecart plugin on all WordPress instances and document the business impact of removal. Within 7 days: conduct a security audit of your WordPress environment to identify the presence of known POP gadget chains (using tools like WordPress plugin vulnerability scanners), review access logs for suspicious activity to the plugin's endpoints, and evaluate alternative plugins that provide equivalent functionality. Within 30 days: complete migration to a patched alternative if wpstorecart is mission-critical, or confirm removal if not, and implement Web Application Firewall rules to block exploitation attempts against deserialization endpoints on WordPress installations.

wpstorecart CVE-2026-84099

EUVD-2026-76794 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-09-12 contact@wpscan.com

GHSA-w3rx-h7m8-2ggf

PHP WordPress Deserialization

8.1

CVSS 3.1 · Vendor: wpscan

Severity by source

Vendor (wpscan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network access (AV:N/PR:N) but AC:H because full exploitation requires a gadget chain; full C/I/A impact conditional on chain availability.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 12, 2026 - 16:29 vuln.today

CVSS changed

Sep 12, 2026 - 16:22 NVD

8.1 (HIGH)

CVE Published

Sep 12, 2026 - 06:16 cve.org

HIGH 8.1

CVE Published

Sep 12, 2026 - 06:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

AnalysisAI

PHP Object Injection in the wpstorecart WordPress plugin (through 5.0.7) exposes an unauthenticated deserialization endpoint bundled as an add-on, permitting attackers to inject arbitrary PHP objects without class restrictions. Exploitation to full system compromise (RCE) is contingent on the presence of a suitable POP gadget chain elsewhere in the WordPress environment - a condition that is common on complex WordPress installations running multiple plugins. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The wpstorecart plugin version ≤5.0.7 must be installed and activated on a WordPress site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.1, with AC:H correctly reflecting that gadget chain availability is a prerequisite - exploitation is not guaranteed against every target. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis - no fixed version is available per WPScan and EUVD data. … Detailed patch versions, workarounds, and compensating controls in full report.