PHP Object Injection in Booster for WooCommerce
Unauthenticated PHP Object Injection in Booster for WooCommerce plugin versions up to 8.4.0, rated CVSS 9.8 critical. No authentication required to trigger.
- Vendor
- WordPress Plugin Ecosystem
- Product
- Booster for WooCommerce (woocommerce-jetpack)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
An unauthenticated PHP Object Injection vulnerability in the Booster for WooCommerce plugin allows a remote, unauthenticated attacker to inject arbitrary PHP objects. If the application’s loaded class pool contains a usable gadget chain, this can result in arbitrary code execution, file manipulation, or other critical impacts.
The vulnerable code calls PHP’s unserialize() on user-supplied input without an authentication check. Any WordPress site running Booster for WooCommerce at or below version 8.4.0 is reachable from the public internet without a login requirement.
Affected versions: Booster for WooCommerce (plugin slug: woocommerce-jetpack) versions up to and including 8.4.0.
Remediation: Update to the patched version via the WordPress admin panel or wp plugin update woocommerce-jetpack. See the Patchstack advisory for the confirmed fixed version number.
Source: Patchstack, NVD
