Unauthenticated PHP Object Injection in Novalnet Payment Gateway

Executive Summary

CVE-2026-57677 is an unauthenticated PHP Object Injection vulnerability found in the Novalnet Payment Gateway plugin for WooCommerce versions 12.10.3 and below.

This flaw allows attackers to inject malicious PHP objects without needing to authenticate, potentially enabling them to execute arbitrary code or perform other harmful actions.

The vulnerability is classified under OWASP Top 10 A3: Injection and has a very high severity score of 9.8, indicating it is highly dangerous.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to severe impacts including code injection, SQL injection, path traversal, denial of service, and other malicious activities.

Because the vulnerability requires no authentication, attackers can exploit it remotely and at scale, potentially affecting thousands of websites.

Such attacks can compromise the confidentiality, integrity, and availability of your systems and data.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is an unauthenticated PHP Object Injection in the Novalnet Payment Gateway for WooCommerce plugin versions 12.10.3 and below. Detection can involve monitoring for exploitation attempts targeting this plugin, especially looking for unusual HTTP requests that may attempt code injection, SQL injection, or path traversal.

Patchstack has provided a mitigation rule to block attacks until the plugin is updated, which implies that IDS/IPS or WAF rules can be used to detect or block exploitation attempts.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective step to mitigate this vulnerability is to update the Novalnet Payment Gateway for WooCommerce plugin to version 12.10.4 or later, where the vulnerability has been patched.

Until the update can be applied, users are strongly advised to implement the mitigation rule provided by Patchstack to block attacks targeting this vulnerability.

Useful 0 Not Useful 0