CVE-2026-43642 in Virtualizor
Summary
by MITRE • 09/22/2026
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Softaculous Virtualizor versions prior to 3.2.9 Patch 9 and version 3.0.0 represents a critical security flaw within the application's billing module handler. This issue is classified under CWE-502, which denotes Deserialization of Untrusted Data. The core technical deficiency lies in the improper handling of user-supplied input during the deserialization process. Specifically, when an attacker sets the act parameter to login and includes the from_billing_module parameter, the application proceeds to deserialize data provided via the billing_data POST field using PHP's unserialize function. Crucially, this operation is performed without any restrictions on allowed classes, leaving the system vulnerable to arbitrary object injection attacks that can be exploited by unauthenticated remote attackers.
The operational impact of this vulnerability is severe due to the potential for Remote Code Execution as root. By supplying maliciously crafted serialized PHP objects, an attacker can leverage available PHP Object Injection chains within the application's dependencies or core codebase. These POP chains allow the manipulation of object states and method calls during deserialization, ultimately leading to the execution of arbitrary system commands with the highest level of privilege on the host server. This capability effectively grants full control over the underlying infrastructure, allowing for data exfiltration, persistence establishment, lateral movement within the network, or complete denial of service through resource exhaustion or destructive command execution.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Initial Access and Execution. The unauthenticated nature of the exploit means it can be leveraged in automated scanning campaigns targeting exposed web interfaces. Attackers typically utilize tools like PHPGGC to generate appropriate payload structures that trigger specific gadget chains within the targeted environment. Once executed, the attacker gains a foothold equivalent to the user running the web server process, which is frequently root or administrator depending on the deployment configuration of Virtualizor instances.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Administrators should upgrade Softaculous Virtualizor to version 3.2.9 Patch 9 or later, where this deserialization flaw has been addressed by implementing strict class whitelisting during object unserialization. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing suspicious serialized data patterns in the billing_data parameter. Additionally, restricting access to the login endpoint via IP allow-listing or multi-factor authentication adds a layer of defense-in-depth, reducing the attack surface available to unauthenticated adversaries attempting to exploit this specific vector.