EUVD-2026-95600
GHSA-qh49-6wvm-jfrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege WordPress account
-
DeliverySubmit crafted serialized payload to plugin
-
ExploitTrigger untrusted deserialization (CWE-502)
-
ExecutionInstantiate malicious PHP object via gadget chain
-
ImpactExecute code / compromise site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with high privileges (CVSS PR:H) - effectively WordPress administrator or equivalent capability - on a site running Pay with Vipps for WooCommerce version n/a through 6.2.0; the plugin must be installed and active. The core trigger is reaching a plugin code path that deserializes attacker-controlled input (CWE-502). Successful object injection typically also requires a usable POP gadget chain present in WordPress core, WooCommerce, or another installed component. The primary limiting factors are the high privilege prerequisite (no unauthenticated or low-privilege path per the vector) and the dependency on an exploitable gadget chain; no user interaction is required (UI:N). |
| Impact | This is a PHP Object Injection flaw (CWE-502) in the Pay with Vipps for WooCommerce plugin, rated CVSS 7.2 (High). The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N shows a network-reachable, low-complexity bug, but critically requires PR:H - high privileges, meaning an authenticated administrator-level account. This high privilege requirement is the dominant risk-limiting factor and substantially lowers real-world exploitability versus an unauthenticated flaw of the same impact. No EPSS score was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced - the only source is the Patchstack advisory. Therefore, despite the HIGH severity and triple-impact (C:H/I:H/A:H), this should be treated as a moderate practical priority: a real deserialization defect worth patching, but gated behind privileged access rather than a wormable or mass-exploitable issue. No conflicting signals were detected between the CVSS vector and description; the main gap is the absence of EPSS, KEV, and POC data, so exploitation likelihood cannot be quantitatively confirmed. |
| Exploit ScenarioDerived | An attacker who has already obtained a high-privilege (administrator-level) WordPress account on a store running Pay with Vipps for WooCommerce ≤ 6.2.0 submits crafted serialized data to a vulnerable plugin entry point. When the plugin deserializes this untrusted input, a malicious PHP object is instantiated, which - chained with a suitable gadget in WordPress, WooCommerce, or another installed plugin - can lead to arbitrary code execution, data disclosure, or site compromise. No public exploit code is referenced, so an attacker would need to develop the payload and gadget chain independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
PHP object injection in the WordPress plugin Pay with Vipps for WooCommerce (wp_hosting_as:pay_with_vipps_for_woocommerce, all versions through 6.2.0) allows an attacker to supply crafted serialized data to a plugin code path that deserializes it without validation. Per the assessed CVSS:3.1 vector (7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), exploitation requires an authenticated account with high privileges - effectively a WordPress administrator or equivalent capability - on a site where the plugin is installed and active, and it yields high confidentiality, integrity and availability impact; no user interaction is required. Practical exploitation further depends on a usable PHP POP gadget chain being present in WordPress core, WooCommerce or another installed component, and no public exploit code or CISA KEV entry was identified at time of analysis, so the high privilege prerequisite is the primary limiting factor.
RemediationAI
The provided intelligence does not confirm a vendor-released fixed version: the only reference is the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-vipps/vulnerability/wordpress-pay-with-vipps-for-woocommerce-plugin-6-2-0-php-object-injection-vulnerability?_s_id=cve), which should be checked for the exact patched release; as soon as a version newer than 6.2.0 is published, update the plugin immediately through the WordPress admin or WP-CLI (wp plugin update woo-vipps), since patch status was unconfirmed at time of analysis. If the Vipps gateway is not actively used, deactivate and delete the plugin - the only fully reliable mitigation for an unpatched object-injection flaw, at the cost of losing that payment method. Where the plugin must stay active, constrain the attack surface by enforcing least privilege and removing unnecessary administrator accounts, since PR:H means only high-privilege authenticated users can reach the vulnerable deserialization path, and by auditing other installed plugins and themes for known POP gadget chains that would make the injection exploitable. A WAF or reverse proxy rule that inspects POST bodies and cookies for serialized object payloads (for example O:<length>:" patterns) targeting the plugin's endpoints can raise the bar, but such signatures are easily bypassed with encoding tricks and should be treated as compensating only. Monitor WooCommerce and WordPress logs for unexpected unserialize()-related errors, fatal errors in the woo-vipps plugin path, and unusual administrative activity, and note that full hardening also requires keeping WordPress core and WooCommerce current so that gadget chains are removed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-502 (Deserialization of Untrusted Data) in a WooCommerce payment-gateway plugin maintained by WP Hosting AS. PHP's unserialize() on attacker-influenced input reconstructs arbitrary objects and triggers their magic methods (__wakeup, __destruct, __toString), which is the classic PHP Object Injection primitive. On its own, object injection is only a stepping stone: impact depends on chaining the injected object into a POP (property-oriented programming) gadget chain exposed by WordPress core, WooCommerce, or any other installed plugin/theme, which can escalate to file deletion, arbitrary file read, SQL injection, or remote code execution. The CPE entry (cpe:2.3:a:wp_hosting_as:pay_with_vipps_for_woocommerce:*:*:*:*:*:*:*:*) uses a wildcard version range and the description bounds the issue to all releases from n/a through 6.2.0, so no patched boundary is conveyed by the CPE data. The CVSS vector shows AC:L with PR:H and UI:N, meaning the vulnerable path is reachable over the network without unusual preconditions but only after an administrator-level login; the report originates from Patchstack's WordPress vulnerability database.
Know when Pay With Vipps For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Deserialization is network-reachable (AV:N) and low-complexity (AC:L) but needs an admin-level account, so PR:H; object injection to code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
Executive ViewAI
The WordPress plugin 'Pay with Vipps for WooCommerce' (versions through 6.2.0) contains a high-severity PHP object injection vulnerability that could allow an authenticated attacker with administrative privileges to execute arbitrary code and fully compromise a website. While exploitation requires high privileges and no public exploit identified at time of analysis, a compromised or malicious administrator account could leverage this flaw to bypass security controls, exfiltrate sensitive data, or disrupt operations. Organizations using this plugin should act promptly to mitigate risk given the absence of a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations include: disabling the plugin if not business-critical, restricting administrative access, enabling multi-factor authentication, deploying WAF rules to block serialized object injection, and monitoring for suspicious deserialization activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Exploit-DB