Executive brief
WPStoreCart is a popular WordPress e-commerce plugin used to build online stores. The plugin contains a critical security flaw that allows unauthenticated attackers to inject malicious PHP code without needing to log in or have special permissions. An attacker could exploit this to compromise the entire WordPress site and steal customer data or take control of the store.
Technical details
The vulnerability is a PHP object injection (CWE-502, insecure deserialization) in a bundled add-on (wpsc-membership-pro paypal.php) that is directly accessible and deserializes user-supplied input without restricting permitted classes. The affected component does not perform authentication checks, allowing unauthenticated attackers to craft malicious serialized objects and inject them via HTTP requests. When deserialized, these objects can be escalated to remote code execution if a suitable gadget chain exists on the site. No patch is currently available as of the advisory publication date.
Affected products
- IDB Ecommerce WPStoreCart through 5.0.7
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory