Description

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-12T06:16:27.020Z",
  "pubdate": "2026-09-12T06:16:27.020Z",
  "executiveSummary": "The wpstorecart WordPress plugin (versions 5.0.7 and earlier) contains a critical security vulnerability involving insecure deserialization of user-supplied input.\nThe flaw exists within a bundled add-on that permits unauthenticated, direct access to a deserialization endpoint.\nBy submitting maliciously crafted serialized objects, an unauthenticated attacker can trigger arbitrary PHP object injection.\nThe primary risk lies in the potential for Remote Code Execution (RCE) or other harmful side effects, provided a suitable gadget chain exists within the WordPress environment or the plugin itself.\nSince the vulnerability is exploitable without authentication, it poses a severe threat to site integrity, confidentiality, and availability.\nAdministrators are urged to treat this as a high-priority risk and restrict access to the affected component immediately.",
  "technicalDetails": "The vulnerability originates from the implementation of PHP's unserialize() function on unsanitized user-provided data within a bundled add-on of the wpstorecart plugin.\nThe root cause is the failure to implement class whitelisting or signature validation before passing input to the deserialization routine. In PHP, the unserialize() function reconstructs objects from serialized strings; if the application does not restrict the classes permitted to be instantiated, an attacker can supply a serialized object of any class present in the application's scope.\nThe attack flow begins with the attacker identifying the entry point for the vulnerable add-on. Because the plugin does not enforce authentication checks for this component, an attacker can send a specially crafted HTTP request containing a serialized payload. The application retrieves this input and passes it directly to the vulnerable function.\nUpon deserialization, the magic methods—such as __wakeup(), __destruct(), or __toString()—of the injected object are automatically invoked by the PHP engine. If the attacker selects a 'gadget' class already defined within the WordPress core, the active theme, or any other installed plugin, they can manipulate the state of the application. By chaining multiple such gadgets, an attacker can influence program execution flow, leading to outcomes ranging from arbitrary file deletion to Remote Code Execution (RCE).\nThis vulnerability is particularly dangerous because it does not require prior knowledge of the target's credentials. It is exposed to the public network, making it susceptible to automated exploitation attempts. The scope of impact is contingent upon the availability of gadget chains; however, in complex WordPress environments with numerous plugins, the likelihood of finding a functional chain is significant.\nPost-exploitation, an attacker may gain persistence, exfiltrate sensitive database information, or pivot within the hosting environment, effectively compromising the entire web server."
}