WordPress Plugin Vulnerabilities

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

Description

The plugin does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

Proof of Concept

Affects Plugins

Plugin icon
wpstorecart
No known fix

References

CVE
CVE-2026-84099

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
8.1 (high)

Miscellaneous

Original Researcher
reconnaissance
Submitter
reconnaissance
Submitter twitter
r3c0nn41554nc3
Verified
Yes
WPVDB ID
11d36ab2-ac8d-42cf-91c0-dea55d7edc9a

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2025-07-01
Title
Forminator Forms < 1.44.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
Published
2026-02-17
Title
Advanced AJAX Product Filters < 3.1.9.7 - Author+ PHP Object Injection
Published
2026-04-08
Title
Micdrop < 1.4 - Unauthenticated PHP Object Injection
Published
2025-02-17
Title
Brooklyn Theme < 4.9.9.3 - Authenticated (Subscriber+) PHP Object Injection in ot_decode
Published
2025-04-16
Title
HelpGent <= 2.2.5 - Unauthenticated PHP Object Injection