CVE-2026-7637: PixelYourSite Boost

Overview

CVE-2026-7637 concerns the Boost plugin for WordPress, listed in the affected product field as PixelYourSite Boost. The weakness is classified as CWE-502 (Deserialization of Untrusted Data). According to the record, the plugin deserializes data taken from the STYXKEY-BOOST_USER_LOCATION cookie without sufficient validation, and this can be reached without authentication.

Impact

• The record describes PHP Object Injection that can be triggered by unauthenticated users.
• The Wordfence description states that no known POP chain exists in the vulnerable software, so the flaw alone has no impact unless another plugin or theme with a POP chain is installed.
• If such a chain exists elsewhere on the site, the description says it may allow deleting arbitrary files, retrieving sensitive data, or executing code, depending on the chain.
• The CVSS 3.1 vector reported by Wordfence rates confidentiality, integrity and availability impact as high.

Affected products and versions

• Product listed: PixelYourSite Boost.
• Versions listed as affected: up to and including 2.0.3.
• The record does not list any fixed version. This does not establish that no fix exists; it means the record contains no fix information.

Exploitation status

• The CISA KEV entry in the record is not listed.
• No confirmed exploitation in the wild appears in the sources consulted.
• The record's SSVC data marks exploitation as none and automatable as yes; this is a scoring input, not evidence of observed attacks.

Remediation and mitigation

• Identify every site running the Boost plugin and check whether the installed version is 2.0.3 or earlier.
• Check the vendor page and the Wordfence record for an updated release, and apply it as soon as it is available.
• Until a fixed version is confirmed, consider disabling or removing the plugin if it is not essential.
• Review other installed plugins and themes, since the severity of this flaw depends on the presence of a usable POP chain elsewhere.
• Keep WordPress core, plugins and themes updated, and restrict who can install or change code on the site.

Detection guidance

• Review web server and application logs for requests carrying unusual values in the STYXKEY-BOOST_USER_LOCATION cookie.
• Monitor for unexpected PHP errors or deserialization-related messages that appear after requests to the site.
• Audit file system changes and new administrative accounts, as these would indicate post-exploitation activity if a POP chain is present.

Limitations of the available information

• The record does not give the exact vulnerable code path, the version in which the issue was introduced, or a fixed version.
• Whether a usable POP chain exists on a given site is unknown from this record and depends on the other software installed.
• The EPSS values in the record are reported as given and their date does not establish any exploitation activity.
• Sources consulted were limited to the references listed in the record.

Frequently asked questions

Which versions of the Boost plugin are affected by CVE-2026-7637?

The record lists versions up to and including 2.0.3 as affected. It does not list a fixed version.

Is this vulnerability known to be exploited in the wild?

The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.

Does this flaw alone allow code execution?

According to the description, no known POP chain exists in the plugin itself, so impact depends on whether another installed plugin or theme provides a usable POP chain.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.