{"id":"CVE-2026-42718","published":"2026-10-10T20:16:36.907","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-8-4-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Booster for WooCommerce plugin versions up to 8.4.0, allowing unauthenticated attackers to inject arbitrary PHP objects that can lead to remote code execution, data compromise, and full system takeover.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and leverages a deserialization flaw in the plugin's handling of user-supplied data, with minimal preconditions needed for successful exploitation.","blast_radius":"The vulnerability could affect thousands of WooCommerce stores running the affected plugin version, potentially leading to widespread compromise of customer data, payment information, and full server control across multiple e-commerce platforms.","remediation":"Upgrade to Booster for WooCommerce version 8.4.1 or later to remediate this critical vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","woocommerce","php-injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:28.602Z"}}