CVE Intelligence
Analysis AI-assisted

CVE-2026-42718: Booster for WooCommerce WordPress Plugin - PHP Object Injection

CVE-2026-42718 is an unauthenticated PHP Object Injection flaw (CWE-502) in the Booster for WooCommerce WordPress plugin, versions up to and including 8.4.0. Patchstack, the CNA, rates it 9.8 critical under CVSS 3.1. The record lists no fixed version and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-42718 affects the Booster for WooCommerce WordPress plugin in versions up to and including 8.4.0. The record describes an unauthenticated PHP Object Injection flaw mapped to CWE-502 (Deserialization of Untrusted Data). It was published on 2026-10-10, with Patchstack listed as the CNA.

Impact

  • The CVSS 3.1 score of 9.8 (critical) is attributed to Patchstack in the record. The vector indicates a network attack, low complexity, no privileges and no user interaction required.
  • The vector rates confidentiality, integrity and availability impact as high.
  • The SSVC data in the record marks technical impact as total and the issue as automatable.

PHP object injection flaws can allow an attacker to influence how application objects are created and used. The real consequences depend on code paths and other components on the site, which the record does not describe.

Affected products and versions

  • Product named in the record: Pluggabl Booster for WooCommerce.
  • Affected versions: up to and including 8.4.0.
  • The title refers to Booster for WooCommerce, so the product naming should be checked against the vendor's own pages.

Exploitation status

The record lists KEV as not listed, so this CVE is not recorded in the CISA KEV catalog as actively exploited. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00386 (percentile 0.30827) as of 2026-10-13, and SSVC exploitation is recorded as none.

Remediation and mitigation

  • The record lists no fixed version. Do not assume a patch exists; check the Patchstack entry and the plugin vendor for a release newer than 8.4.0.
  • If the plugin is installed at version 8.4.0 or earlier and no fixed release is confirmed, consider disabling or removing it until a vendor fix is verified.
  • Limit exposure of affected sites where feasible, and keep WordPress core, themes and other plugins updated.
  • Inventory all sites and staging environments to confirm whether the plugin is present.

Detection guidance

  • Identify every WordPress installation that uses the plugin and record its version.
  • Review web server and application logs for unusual requests reaching the plugin, and for unexpected changes to site files or administrator accounts.
  • Watch for anomalous behavior on sites where the plugin is reachable by unauthenticated visitors.

Limitations of the available information

  • The record provides no fixed version, no patch details and no technical description of the vulnerable code path.
  • The product name in the affected field differs from the title, which creates ambiguity about the vendor.
  • Whether the vulnerable functionality is reachable depends on site configuration, which is unknown.
  • The NVD and CVE.org pages are listed as sources, but the record contains only their identifiers.

Frequently asked questions

Is CVE-2026-42718 known to be actively exploited?

The record lists the CVE as not present in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. SSVC exploitation is recorded as none.

Which versions of Booster for WooCommerce are affected?

The record lists versions up to and including 8.4.0. No fixed version is provided in the record, so check the vendor for an update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.