{"id":"CVE-2026-42716","published":"2026-10-10T20:16:36.630","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/payever-woocommerce-gateway/vulnerability/wordpress-payever-woocommerce-gateway-plugin-4-8-2-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in the Payever WooCommerce payment gateway plugin for WordPress versions up to 4.8.2, allowing unauthenticated attackers to inject arbitrary PHP objects and potentially execute remote code on the affected system.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request to the vulnerable plugin endpoint, with minimal prerequisites beyond having the plugin installed.","blast_radius":"The vulnerability could impact thousands of WordPress sites running the affected Payever plugin version, potentially leading to full system compromise through remote code execution.","remediation":"Upgrade to Payever WooCommerce Gateway version 4.8.3 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","php","woocommerce"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:23.392Z"}}