CVE Intelligence
Analysis AI-assisted

CVE-2026-42716: Payever WooCommerce Gateway (WordPress) - Unauthenticated PHP Object Injection

CVE-2026-42716 is an unauthenticated PHP Object Injection flaw (CWE-502) in the Payever - WooCommerce Gateway WordPress plugin, versions up to and including 4.8.2. Patchstack reports a CVSS 3.1 base score of 9.8 (critical). The sources consulted show no confirmed exploitation, and the record does not identify a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Payever - WooCommerce Gateway plugin for WordPress is affected by an unauthenticated PHP Object Injection flaw, classified as CWE-502 (Deserialization of Untrusted Data), in versions up to and including 4.8.2. The record was published by Patchstack as the CNA. Details are available in the Patchstack vulnerability entry.

Impact

  • Patchstack reports a CVSS 3.1 base score of 9.8 (critical), and the vector in the record indicates network access, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability.
  • The SSVC data in the record rates technical impact as total and the vulnerability as automatable.
  • Deserialization flaws of this type can allow an attacker to influence application objects, so the effect depends on the code paths present in the plugin and its environment, which the record does not describe.

Affected products and versions

  • Payever Payever - WooCommerce Gateway, versions up to and including 4.8.2.
  • The record does not list any fixed version.

Exploitation status

  • The CISA KEV catalog does not list this CVE, so no active exploitation is reported by KEV.
  • The SSVC exploitation field is recorded as none, and the EPSS probability is 0.00386 (percentile 0.30826) dated 2026-10-13.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory WordPress sites that use the Payever - WooCommerce Gateway plugin and compare the installed version with the affected range.
  • Check the vendor and the Patchstack entry for a fixed release, since the record does not name one. A missing fixed version in the record does not confirm that no fix exists.
  • Where the plugin is not essential, consider deactivating it until a verified update is applied.
  • Keep WordPress, WooCommerce and all plugins on supported, current releases, and apply any vendor-recommended hardening.

Detection guidance

  • Review web server and application logs for unusual unauthenticated requests to the plugin's endpoints, particularly requests carrying serialized data.
  • Monitor for unexpected file changes, new administrative accounts or unexpected outbound connections from WordPress hosts.

Limitations of the available information

  • The record does not describe the vulnerable component, the exact code path or the conditions required for impact.
  • No fixed version, vendor patch reference or NVD-assigned score is present in the record.
  • The record does not include evidence of exploitation beyond the KEV status and SSVC fields.

Frequently asked questions

Which versions of the Payever WooCommerce Gateway plugin are affected by CVE-2026-42716?

The record lists the plugin as affected up to and including version 4.8.2. It does not list any fixed version, so administrators should check the vendor or Patchstack entry for an update.

Is CVE-2026-42716 being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none.

What kind of weakness is CVE-2026-42716?

It is classified as CWE-502, Deserialization of Untrusted Data, which is reported as a PHP Object Injection issue that can be triggered without authentication.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.