CVE-2026-84099 in wpstorecart Plugin
Summary
by MITRE • 09/12/2026
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in wpstorecart WordPress plugin versions through 5.0.7 represents a critical security flaw rooted in insecure deserialization practices. The core issue lies within a bundled add-on component that fails to implement proper access controls, allowing direct and unauthenticated HTTP requests to reach the vulnerable endpoint. This lack of authentication requirement means that any external actor on the internet can interact with this specific functionality without needing valid credentials or session tokens associated with the WordPress installation.
At the technical level, the vulnerability is characterized by the use of PHP's unserialize function on user-supplied input data. The plugin does not restrict the set of classes that are permitted to be instantiated during the deserialization process. This unrestricted deserialization allows an attacker to craft a serialized payload containing arbitrary PHP objects. When these malicious objects are processed by the application, they trigger their respective magic methods or constructors, leading to unintended code execution paths within the context of the web server.
The operational impact of this vulnerability is severe, as it effectively grants unauthenticated remote code execution capabilities to any attacker who can reach the vulnerable endpoint. By injecting specific PHP object instances that leverage existing classes available in the WordPress environment or other installed plugins and themes, an attacker can construct a gadget chain. This chain exploits common libraries such as Guzzle, Monolog, or Symfony components, which are frequently present in modern web applications. The successful exploitation allows the attacker to execute arbitrary system commands, read sensitive files including database configuration files containing credentials, modify website content, or use the compromised server as part of a botnet.
This vulnerability aligns with CWE-502, Deserialization of Untrusted Data, which highlights the danger of processing data from unverified sources without validating its integrity and origin. Furthermore, in terms of offensive security frameworks, this attack vector corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through PHP execution mechanisms like T1059.004. The initial access phase is facilitated by the lack of authentication controls, which can be mapped to MITRE ATT&CK tactic TA0001, Initial Access, often involving exploitation of software vulnerabilities for remote code execution.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. Administrators should immediately update the wpstorecart plugin to version 5.0.8 or later where this issue has been resolved by implementing strict class whitelisting during deserialization operations. If updating is not immediately feasible, temporary mitigations include restricting access to the specific endpoint via web server configuration rules such as those in Apache's mod_rewrite or Nginx location blocks, effectively blocking unauthenticated requests until a patch can be applied. Additionally, organizations should review their PHP configurations to disable dangerous functions if possible and ensure that all third-party plugins are kept up to date to minimize the availability of exploitable gadget chains within the application environment.