Booster for WooCommerce Has CVSS 9.8 Object Injection

Booster for WooCommerce, a plugin that extends WooCommerce stores with over 100 additional features and carries several million active installs, contains an unauthenticated PHP Object Injection vulnerability in all versions up to and including 8.4.0. Patchstack rates it CVSS 9.8 critical and has published an advisory as CVE-2026-42718.

What the flaw is

PHP Object Injection occurs when an application calls PHP’s unserialize() on attacker-controlled data before authenticating the request. Deserialization automatically triggers any __wakeup() or __destruct() magic methods on the resulting object. In a WordPress installation running multiple plugins, the available class pool is wide: a single gadget class anywhere in the loaded codebase is enough to chain method calls into arbitrary file writes, deletion, or code execution, depending on what the plugin ecosystem provides.

The key detail here is the authentication level: none. The attacker does not need a WordPress account to reach the vulnerable code path.

Affected versions

Booster for WooCommerce (WordPress plugin slug: woocommerce-jetpack), versions up to and including 8.4.0.

What to do

Update the Booster for WooCommerce plugin through the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI:

wp plugin update woocommerce-jetpack

The Patchstack advisory lists the fixed version and carries the full technical write-up. If an immediate update is not possible, disable the plugin temporarily, particularly on stores with public-facing product or checkout endpoints.

Context

This is the latest in a string of critical severity disclosures across the WooCommerce plugin ecosystem this week. Three other WooCommerce plugins needed patches earlier this week at CVSS ratings between 9.1 and 9.8, covering an RCE, an authentication bypass, and an arbitrary file deletion. Patchstack published advisories for multiple WooCommerce plugins within the same disclosure window.

The broader SiteVault RCE (CVSS 10.0) published today adds to a difficult week for WordPress-based store operators. If you run WooCommerce and have not audited your active plugins against current advisories, this week is the time to do it.

The Patchstack database is the primary source for WordPress plugin CVEs of this class. Their advisory for CVE-2026-42718 is the reference to follow for patched version confirmation.