Critical Unauthenticated PHP Injection Flaw Found in Payever WooCommerce Plugin

The National Vulnerability Database has published a record for CVE-2026-42716, identifying a critical security flaw in the Payever WooCommerce Gateway plugin. This vulnerability enables unauthenticated PHP object injection, posing a severe risk to e-commerce sites relying on this payment gateway integration.

Security researchers and the NVD rate this issue with a CVSS score of 9.8, marking it as critical. The weakness stems from CWE-502, which involves the deserialization of untrusted data. Attackers can exploit this flaw without needing any user credentials or prior access to the administrative interface of the WordPress site.

Technical Context and Background

The core of this vulnerability lies in how the plugin handles incoming data requests. According to the NVD description, the flaw allows for unauthenticated PHP object injection. This type of attack typically occurs when an application deserializes user-controlled data without proper validation or integrity checks.

PHP object injection can lead to remote code execution, allowing attackers to run arbitrary commands on the server. The NVD record explicitly links this issue to CWE-502, a common weakness enumeration category for deserialization of untrusted data. This classification highlights the danger of trusting external inputs during the object reconstruction process.

The severity rating of 9.8 indicates that the exploitability and impact are both high. Because the attack requires no authentication, any internet-connected instance of the vulnerable plugin is exposed. This makes the flaw particularly dangerous for public-facing WooCommerce stores that have not implemented additional network-level protections.

Who Is Affected

The vulnerability affects users of the Payever WooCommerce Gateway plugin. Specifically, the NVD record states that versions up to 4.8.2 are impacted. This includes version 4.8.2 and all previous releases of the software.

Payever is a payment service provider, and its WooCommerce gateway allows merchants to accept payments directly on their WordPress-based online stores. Any store administrator who has installed this plugin and has not updated beyond version 4.8.2 is currently using vulnerable software.

The impact is widespread because WooCommerce is one of the most popular e-commerce platforms globally. Merchants using Payever for transaction processing must verify their current plugin version immediately. If the installed version is 4.8.2 or lower, the site is susceptible to this critical injection attack.

What should you do?

Site administrators should verify the current version of the Payever WooCommerce Gateway plugin installed on their servers. If the version is 4.8.2 or earlier, they should check for an updated release from the vendor that addresses CVE-2026-42716.

Monitor server logs for unusual activity or signs of unauthorized code execution. Look for unexpected PHP processes or outbound connections that do not match normal site traffic patterns. These indicators may suggest an attacker is exploiting the injection flaw.

Restrict access to administrative interfaces where possible using IP whitelisting or multi-factor authentication. While this does not fix the underlying plugin vulnerability, it reduces the attack surface for other potential entry points.