PT-2026-7487 · WordPress · Wp Ecommerce
CVE-2026-1235
·
Publicado
2026-02-11
·
Atualizado
2026-02-11
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
WP eCommerce versions through 3.15.1
Description
The WP eCommerce WordPress plugin is affected by an issue where it unserializes user input through AJAX actions. This could allow unauthenticated users to perform PHP Object Injection if a suitable gadget is present. The
ajax actions are the entry point for this issue. The vulnerable component processes user-supplied data without proper sanitization, leading to the potential for arbitrary code execution.Recommendations
Update WP eCommerce to a version beyond 3.15.1.
Disable the plugin until a patch is available.
Exploit
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wp Ecommerce