CVE-2026-84099

The wpstorecart WordPress plugin, through version 5.0.7, does not prevent direct, unauthenticated access to a bundled add-on that deserializes attacker-supplied input without restricting the permitted PHP classes. A remote, unauthenticated attacker can send a crafted serialized payload to this add-on and inject arbitrary PHP objects into the application. The injected objects can be escalated — potentially to remote code execution, data theft, or site takeover — when a suitable gadget chain (e.g., from another installed plugin or theme) is present on the site, which is why the CVSS attack complexity is rated high. Any WordPress site running wpstorecart 5.0.7 or earlier is affected, with no privileges or user interaction required to trigger the flaw. No public proof of concept is known, the CVE is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

What to do: Because the advisory identifies no fixed version, the safest action is to deactivate and remove wpstorecart (5.0.7 or earlier) from any site still running it and migrate to a actively maintained e-commerce plugin. If removal must be delayed, block direct, unauthenticated HTTP requests to the bundled add-on via a WAF or server-level rule. Operators should also audit affected sites for signs of compromise such as unexpected administrator accounts, modified plugin or theme files, and unknown scheduled tasks.