CVE-2026-43642
Received Received - Intake

PHP Object Injection in Virtualizor Billing Module

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulnCheck

Description
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-43642
EUVD
EUVD-2026-84622

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
softaculous virtualizor to 3.2.9 (exc)
softaculous virtualizor to 3.2.9|end_excluding=3.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP object injection vulnerability in Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0. It allows unauthenticated remote attackers to inject malicious serialized PHP objects via the billing_data POST field. The unserialize() function processes these objects without proper class restrictions, enabling attackers to exploit POP chains for remote code execution as root.

Detection Guidance

Check Virtualizor version using the admin panel or run: curl -s http://your-server.com/admin.php | grep -i virtualizor. If version is below 3.2.9 (Patch 9) or 3.3.0, the system is vulnerable. Monitor POST requests to billing_data field for unusual serialized data patterns.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system with root privileges. This could lead to full system compromise, data theft, or unauthorized access to sensitive information. Unpatched systems are at high risk of remote exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive data.

Mitigation Strategies

Upgrade Virtualizor to version 3.2.9 (Patch 9) or 3.3.0 immediately. If immediate upgrade is not possible, disable the billing module handler by setting act parameter restrictions or blocking POST requests to billing_data field until patching is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart