CVE-2026-84099
Received Received - Intake

Unauthenticated PHP Object Injection in wpStoreCart WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-84099
EUVD
EUVD-2026-76794

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpstorecart wpstorecart to 5.0.7 (exc)
wpstorecart wpstorecart 5.0.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated PHP Object Injection flaw in the wpStoreCart WordPress plugin versions 5.0.7 and below. It occurs because a bundled add-on deserializes user-supplied input without restricting permitted classes, allowing attackers to inject arbitrary PHP objects. If a suitable gadget chain exists on the site, this could lead to further exploitation.

Detection Guidance

Check if the wpStoreCart plugin version 5.0.7 or below is installed. Look for the vulnerable add-on file wpsc-membership-pro/paypal.php in the plugin directory. No specific commands are provided in the context, but inspecting plugin files and versions is recommended.

Impact Analysis

This vulnerability allows unauthenticated attackers to inject arbitrary PHP objects into your WordPress site. If a gadget chain is present, it could lead to remote code execution, data theft, or complete site compromise. Attackers could gain control over your site without needing any user credentials.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in unauthorized data exposure, leading to legal penalties and compliance violations.

Mitigation Strategies

Immediately update the wpStoreCart plugin to the latest version if an update is available. If no update exists, consider disabling the plugin until a patch is released. Monitor the plugin's official channels for security updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart