Executive brief
The Boost plugin for WordPress, which is used to optimize site performance, contains a security flaw that allows unauthorized users to inject malicious code. By sending a specially crafted browser cookie, an attacker could potentially take control of the website, delete files, or steal sensitive information. This risk is particularly high if the website also uses other plugins or themes with specific underlying vulnerabilities that the attacker can chain together.
Technical details
The vulnerability is a PHP Object Injection flaw (CWE-502) residing in the Boost plugin for WordPress. The root cause is the unsafe deserialization of user-supplied data provided through the 'STYXKEY-BOOST_USER_LOCATION' cookie. An unauthenticated remote attacker can exploit this by sending a crafted request containing a serialized PHP object. While the plugin itself does not contain a known Property-Oriented Programming (POP) chain, the vulnerability can be weaponized if another installed plugin or theme provides a POP chain. Successful exploitation could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution depending on the available chains. The issue affects all versions up to and including 2.0.3.
Affected products
- PixelYourSite Boost up to, and including, 2.0.3
Timeline
- 2026-05-20: disclosed: CVE published to the NVD dataset.