CVE-2026-116869

Name of the Vulnerable Software and Affected Versions myPOS Checkout versions prior to 1.4.6

Description The myPOS Checkout plugin for WordPress allows authenticated attackers with shop manager-level access or higher to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the plugin, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update the plugin to a version newer than 1.4.5.