Description

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-10T20:16:36.630Z",
  "pubdate": "2026-10-10T20:16:36.630Z",
  "executiveSummary": "The Payever - WooCommerce Gateway plugin, in versions up to and including 4.8.2, contains a critical security vulnerability categorized as PHP Object Injection. This flaw arises from the insecure handling of serialized data, which allows unauthenticated remote attackers to inject malicious objects into the application scope. By crafting a specific serialized payload, an attacker can manipulate the application's internal state or trigger dangerous behaviors within existing PHP classes present in the environment.\nThe impact of this vulnerability is severe, potentially leading to Remote Code Execution (RCE), unauthorized file manipulation, or sensitive data exposure depending on the available 'gadget chains' within the site's codebase. Because the vulnerability is exploitable without authentication, it poses a significant risk to any WooCommerce store running the affected plugin versions. Exploitation requires no prior privileges or interaction from an administrator, making this an attractive target for automated exploitation tools seeking to compromise WordPress-based e-commerce platforms.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper sanitization and validation of user-supplied input that is subsequently passed into the PHP unserialize() function. PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to control the properties of existing objects within the PHP application memory space.\nIn the context of the Payever - WooCommerce Gateway <= 4.8.2, the vulnerability manifests when the plugin processes requests containing serialized data, likely transmitted via HTTP POST parameters or cookies, which are then passed to unserialize() without adequate verification. Because the plugin is a WooCommerce extension, the environment inherently contains various classes and methods (gadgets) that can be leveraged during the object restoration process.\nThe attack flow proceeds as follows: First, the attacker identifies an entry point within the plugin's request handling logic that accepts serialized data from a user-controlled source. Second, the attacker crafts a malicious serialized string representing a PHP object. This string is constructed to leverage 'gadget chains'—a sequence of method calls, such as magic methods like __destruct(), __wakeup(), or __toString(), already defined in the theme or other active plugins. Third, the attacker sends this payload to the vulnerable endpoint via an unauthenticated HTTP request.\nUpon deserialization, the PHP engine instantiates the object based on the attacker's input, triggering the magic methods and allowing the execution of unintended code paths. By carefully selecting properties within the injected object, the attacker can redirect the execution flow to perform actions such as invoking system commands, deleting files, or modifying application configurations. Since the plugin is publicly accessible, the attack surface is exposed over the network, permitting remote exploitation.\nThe post-exploitation impact is dictated by the specific gadgets available in the server's environment. In many WordPress environments, the abundance of plugins and themes increases the likelihood of finding a suitable gadget chain to achieve full Remote Code Execution (RCE). If successful, the attacker gains the ability to execute arbitrary code with the same permissions as the web server process, leading to a complete system compromise, database exfiltration, or the installation of persistent backdoors."
}