Unauthenticated PHP Object Injection Flaw in Booster for WooCommerce Rated Critical

The National Vulnerability Database has recorded a critical security flaw in the Booster for WooCommerce plugin. The vulnerability, identified as CVE-2026-42718, allows for unauthenticated PHP object injection in versions of the software up to 8.4.0.

According to the NVD record, the issue carries a CVSS score of 9.8, placing it in the highest severity category. The weakness is mapped to CWE-502, which describes the risk of unauthenticated PHP object injection. This classification indicates that an attacker can manipulate serialized objects without needing valid credentials to access the application.

Context and Background

The vulnerability stems from how the plugin handles serialized data. PHP object injection occurs when an application deserializes untrusted data without proper validation or integrity checks. Attackers can craft malicious serialized strings that, when processed by the application, execute arbitrary code or perform other unintended actions.

This type of flaw is particularly dangerous because it often requires no prior authentication. The attacker does not need a user account or login session to exploit the weakness. Instead, they can send a crafted request directly to the vulnerable endpoint on the web server.

The National Vulnerability Database entry explicitly notes that the flaw exists in unauthenticated contexts. This means the attack surface is exposed to anyone on the internet who can reach the server hosting the WooCommerce site. The lack of authentication requirements significantly increases the risk of automated exploitation by bots scanning for known vulnerabilities.

Who Is Affected

The vulnerability specifically impacts users of the Pluggabl Booster for WooCommerce plugin. The affected software versions include all releases up to and including version 8.4.0. Any website running this plugin within that version range is potentially vulnerable to exploitation.

WooCommerce is a widely used e-commerce platform built on WordPress. Plugins like Booster for WooCommerce add functionality to these stores, making them attractive targets for attackers seeking to compromise retail infrastructure. The broad adoption of WooCommerce means that a significant number of websites may be running the affected plugin versions.

Site administrators must verify their current plugin version immediately. If the installed version is 8.4.0 or lower, the site is considered at risk. The NVD record does not mention any versions higher than 8.4.0, implying that the flaw is present in the entire lineage up to that point.

What should you do?

Security professionals should audit their WordPress installations for the presence of the Booster for WooCommerce plugin. Verify the specific version number against the affected range. If the plugin is installed, monitor server logs for unusual activity or unexpected serialized data submissions.