CVE-2026-42718

Published Oct 10, 2026

Last updated a day ago

CVSS critical 9.8
WooCommerce
Booster for WooCommerce

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42718 is an unauthenticated PHP Object Injection vulnerability affecting the "Booster for WooCommerce" WordPress plugin (also known as `woocommerce-jetpack`) in versions up to and including 8.4.0. The issue stems from the unsafe deserialization of untrusted, user-supplied data (CWE-502). Because the plugin does not sufficiently validate or sanitize input before passing it to a deserialization function, a remote attacker can manipulate how the site processes data, allowing arbitrary input to be interpreted as PHP objects. Exploiting this vulnerability does not require authentication or user interaction, and it can be executed remotely over the network. The practical impact of the injection depends on the specific classes and "gadget chains" available within the target WordPress environment, which can potentially lead to unauthorized file access, data manipulation, or arbitrary code execution. To address this vulnerability, users are advised to update the plugin to version 8.5.0 or later, which contains the official patch.

Description
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
Source
audit@patchstack.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

audit@patchstack.com
CWE-502

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

2

  1. 🚨 8–12 Ekim 2026 tarihlerinde yayınlanan WooCommerce Core ve eklentilere ait güvenlik açıkları: 🔴 CVE-2026-103889 — CVSS 9.8 (CRITICAL) 3D Product Configurator for WooCommerce: Kimlik doğrulaması gerektirmeyen uzaktan kod çalıştırma (RCE) açığı. 🔴 CV

    @ridvanyagli

    12 Oct 2026

    1017 Impressions

    0 Retweets

    13 Likes

    4 Bookmarks

    0 Replies

    0 Quotes

  2. Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-42718 Vendor → Unknown Severity → Critical — CVSS 9.8 Product → Unknown Date → 2026-10-10 A critical vulnerability (Deserialization of Untruste

    @ThreatAtlas

    10 Oct 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.•CVE-2026-103889
  2. The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.•CVE-2026-15369
  3. The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.•CVE-2026-3985
  4. The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.•CVE-2025-2266

References

Sources include official advisories and independent security research.