CVE-2026-94568 in Pay With Vipps for WooCommerce Plugin
Summary
by MITRE • 10/09/2026
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw resides within the WP Hosting AS plugin known as Pay with Vipps for WooCommerce, specifically affecting versions ranging from no specific lower bound up to version 6.2.0. This vulnerability is classified under CWE-502, which denotes Deserialization of Untrusted Data. The core technical issue involves the application's handling of serialized objects received from external sources without adequate validation or sanitization prior to processing. In PHP-based environments such as WordPress plugins, deserialization functions like unserialize() can be exploited if they process data that has been tampered with by an attacker. When untrusted input is passed directly into these functions, it allows for the instantiation of arbitrary classes and the invocation of their methods, leading to a condition known as Object Injection. This mechanism bypasses standard security controls because the application trusts the structure and content of the incoming serialized data implicitly, assuming it originates from a legitimate source rather than an adversary seeking to manipulate system behavior.
The operational impact of this vulnerability is severe, potentially granting attackers full remote code execution capabilities on the affected server. By crafting malicious serialized payloads that exploit public properties or magic methods within PHP classes available in the WordPress environment, an attacker can execute arbitrary commands, access sensitive database credentials, modify site content, or install persistent backdoors. This level of compromise undermines the confidentiality, integrity, and availability of the web application and its underlying infrastructure. Since WooCommerce is a widely used e-commerce platform, successful exploitation could lead to significant financial loss through transaction manipulation, theft of customer payment data, and reputational damage for businesses relying on this plugin for secure Vipps payments. The attack vector typically requires interaction with specific endpoints or forms within the plugin that accept user input which eventually flows into deserialization routines, making it accessible to authenticated users if such access is required, though some implementations may allow unauthenticated exploitation depending on how data is routed through the WordPress hook system.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as well as T1203, Exploitation for Client Execution, if the payload leads to further lateral movement or persistence mechanisms. The lack of input validation represents a fundamental failure in secure coding practices where developers assume data integrity without explicit verification. To mitigate this risk, immediate action is required by updating the Pay with Vipps for WooCommerce plugin to version 6.2.1 or later, where the deserialization logic has been corrected to prevent object injection. In cases where an update is not immediately feasible, administrators should restrict access to affected endpoints using web application firewalls that can detect and block malformed serialized data patterns. Additionally, implementing strict input validation on all user-supplied fields before they are processed by any internal functions serves as a critical defense-in-depth measure. Developers must also avoid using generic deserialization methods for untrusted inputs; instead, they should utilize safer alternatives such as JSON decoding with explicit type checking or implement allowlists for expected object types to ensure that only legitimate data structures are instantiated within the application context.