CVE-2026-42718: Critical Code Execution Risk in Booster for WooCommerce Versions Up to 8.4.0

The National Vulnerability Database has published a record for CVE-2026-42718, identifying a critical security flaw in the Booster for WooCommerce plugin. This vulnerability allows unauthenticated attackers to perform PHP object injection on affected systems.

What happened

The National Vulnerability Database issued a record for CVE-2026-42718, which describes a critical security vulnerability within the Booster for WooCommerce plugin. The flaw is categorized as an unauthenticated PHP object injection weakness, aligning with Common Weakness Enumeration identifier CWE-502. This classification indicates that the application fails to properly sanitize or validate serialized objects before deserializing them.

The vulnerability affects all versions of the Booster for WooCommerce plugin released by Pluggabl up to and including version 8.4.0. The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, marking it as Critical. This high severity rating reflects the ease with which an attacker can exploit the flaw without needing prior authentication credentials or user interaction.

Security researchers and automated scanners can identify the presence of this vulnerability by checking the plugin version installed on a WordPress site. Any deployment running Booster for WooCommerce version 8.4.0 or earlier is considered affected. The unauthenticated nature of the attack vector means that remote attackers can potentially target these systems directly from the internet without needing to log in.

Why it matters

Unauthenticated PHP object injection flaws represent a severe risk to web application security because they bypass standard access controls. Attackers can exploit this weakness to manipulate application behavior or execute arbitrary code on the server hosting the WooCommerce store. The CVSS score of 9.8 indicates that the impact of a successful exploit is likely to be catastrophic for the affected system.

WooCommerce is one of the most widely used e-commerce platforms, making plugins like Booster for WooCommerce attractive targets for cybercriminals. A successful exploit could lead to full server compromise, data theft, or the installation of malicious software. Security operations teams must prioritize patching or mitigating this issue because the lack of authentication requirements lowers the barrier for exploitation.

The specific nature of object injection attacks often allows attackers to chain vulnerabilities or bypass security filters that are designed to stop traditional injection attacks. This makes the flaw particularly dangerous for organizations that rely on standard web application firewalls for protection. The widespread use of WordPress and WooCommerce means that a large number of internet-facing servers are potentially exposed to this specific threat vector.

Our take on the response

The National Vulnerability Database record provides clear identification of the affected software and the severity of the issue. However, the source material does not confirm whether a patched version of the plugin has been released by Pluggabl. Security teams should monitor vendor communications for updates regarding version 8.4.1 or later.

In the absence of a confirmed fix, organizations must rely on compensating controls to reduce the risk. This includes restricting access to the affected servers and ensuring that logging is enabled to detect suspicious activity. The critical nature of the CVSS score demands immediate attention from IT and security personnel responsible for maintaining WooCommerce environments.

Background: Compensating controls

Compensating controls are alternative measures used when primary security requirements cannot be met due to technical or operational constraints. They must provide equivalent protection against specific threats. These controls require rigorous documentation and regular review to ensure they remain effective as systems and threats evolve.

Read the full guide: Compensating Controls: When Standard Fixes Fail

What to do and how to stay safe: Booster for WooCommerce

• Audit all WordPress installations to identify if Booster for WooCommerce is installed and check if the version is 8.4.0 or lower.
• Monitor server logs for unusual PHP execution patterns or unexpected object serialization attempts that may indicate exploitation.
• Restrict network access to the administrative interfaces of WooCommerce sites to reduce the attack surface for unauthenticated threats.
• Verify with the vendor whether a patched version has been released and apply it once available to address CVE-2026-42718.

Step-by-step guide: Web Application Firewall Checklist: Configuration, Logic, and Bypass Prevention

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-42718?

The National Vulnerability Database rates CVE-2026-42718 with a CVSS score of 9.8, which is considered Critical.

Which versions of Booster for WooCommerce are affected by this vulnerability?

All versions of the Booster for WooCommerce plugin up to and including version 8.4.0 are affected by this flaw.

What type of weakness is CVE-2026-42718?

It is an unauthenticated PHP object injection vulnerability, classified as CWE-502.