EUVD-2026-96448
GHSA-hqp4-gqgp-vfhp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress endpoint over network
-
DeliverySubmit crafted serialized PHP object
-
ExploitTrigger unsafe unserialize() (CWE-502)
-
ExecutionInstantiate malicious object / POP chain
-
ImpactExecute code or manipulate site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The site must run the Payever - WooCommerce Gateway plugin at version 4.8.2 or earlier (with WordPress + WooCommerce active). Exploitation requires reaching a plugin code path that calls PHP unserialize() on attacker-supplied input; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this is remote and unauthenticated against default installations, requiring no user interaction or credentials. The practical LIMITING factor for CWE-502 object injection is the availability of a usable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin - without such a chain the injection may not reach full code execution, which tempers the real-world impact relative to the 9.8 score. |
| Impact | All available severity signals point the same direction: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8 Critical) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, which is consistent with CWE-502 (deserialization of untrusted data) and the 'Unauthenticated PHP Object Injection' description. However, the escalating signals that would make this an immediate emergency are ABSENT from the provided data: no EPSS probability is supplied, there is no CISA KEV listing, and no public exploit/POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' An important caveat specific to CWE-502 PHP Object Injection: the raw 9.8 assumes worst-case C:H/I:H/A:H, but practical impact depends on whether a usable POP gadget chain exists in the plugin, WooCommerce, WordPress core, or another loaded plugin; without a confirmed chain the injection may yield less than full RCE. Net assessment: treat as a high-priority patch item because the entry point is unauthenticated and network-facing, but the lack of EPSS/KEV/POC signals means there is no evidence of active or widespread exploitation yet - this is 'patch promptly,' not 'drop-everything incident.' |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the Payever WooCommerce Gateway plugin (<= 4.8.2), supplying a malicious serialized PHP object to an endpoint that deserializes untrusted input. If a suitable POP gadget chain is available in the loaded code base, the injected object triggers unintended method calls that can lead to arbitrary code execution, data disclosure, or site compromise. No public POC is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
RemediationAI
No vendor-released patch is identified in the available data; confirm the current fixed release in the Patchstack advisory and upgrade Payever - WooCommerce Gateway beyond 4.8.2 as soon as a patched version is available. If an immediate update is not possible, deactivate and remove the plugin until a fix is applied, accepting that this disables the Payever payment gateway on the site. As compensating controls, deploy a WAF or virtual patching rule to block PHP object injection payloads targeting the plugin's remote endpoints, restrict access to plugin-specific AJAX/REST routes where operationally feasible, and monitor logs for serialized-object attack patterns; these controls can introduce false positives or break legitimate payment flows. Do not rely on generic input sanitization alone for CWE-502, and verify the plugin's fixed version before restoring it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, deserialization of untrusted data, in the Payever - WooCommerce Gateway WordPress plugin. The plugin exposes a remote, unauthenticated code path that calls PHP's unserialize() on attacker-supplied input, allowing construction of arbitrary PHP objects. Because PHP object injection alone does not guarantee code execution, the CVSS 9.8 rating assumes a worst-case outcome; actual impact is limited by whether a POP gadget chain is available in the plugin, WooCommerce, WordPress core, or another installed plugin. The CPE cpe:2.3:a:payever:payever_-_woocommerce_gateway:*:*:*:*:*:*:*:* identifies the affected plugin, and the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms remote, low-complexity, unauthenticated exploitation with high CIA impact.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization gives AV:N/AC:L/PR:N/UI:N; PHP object injection via a POP chain can yield full code execution, so C/I/A:H with scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
Articles & Coverage 1
Executive ViewAI
The Payever WooCommerce Gateway plugin (versions up to and including 4.8.2) contains a critical object injection flaw that can be reached over the network without prior credentials, placing any WordPress/WooCommerce storefront running it at risk of full site takeover. Because these systems process customer orders, payment-adjacent data, and often hold administrator credentials, a successful attack could disrupt revenue-generating checkout flows and expose sensitive customer information. Leadership should treat this as a priority remediation item for all e-commerce properties, particularly given that no vendor patch is currently available and exploitation may be achievable depending on available code gadgets on the host.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Payever WooCommerce Gateway plugin where operationally feasible; deploy WAF/virtual patching rules to block serialized object payloads on plugin endpoints; restrict network access to affected endpoints; review PHP and web logs for deserialization attempts; scan for webshells and unauthorized administrative accounts; rotate associated credentials; and monitor the vendor advisory for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB