CVE-2026-42718

Summary

A critical PHP object injection vulnerability exists in Booster for WooCommerce plugin versions up to 8.4.0, allowing unauthenticated attackers to inject arbitrary PHP objects that can lead to remote code execution, data compromise, and full system takeover.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and leverages a deserialization flaw in the plugin's handling of user-supplied data, with minimal preconditions needed for successful exploitation.

Blast radius

The vulnerability could affect thousands of WooCommerce stores running the affected plugin version, potentially leading to widespread compromise of customer data, payment information, and full server control across multiple e-commerce platforms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Booster for WooCommerce version 8.4.1 or later to remediate this critical vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.