WooCommerce Sites Face Critical CVE-2026-42718 Risk from Booster Plugin's Unauthenticated Object Injection

Organisations running specific versions of the Booster for WooCommerce plugin face a critical security exposure due to an unauthenticated PHP object injection flaw. According to the National Vulnerability Database record, the issue is assigned CVE-2026-42718 and has been assigned a maximum CVSS base score of 9.8. This high severity rating highlights the significant potential impact on affected systems and the ease with which the flaw can be triggered without prior authentication.

The vulnerability specifically impacts versions of the Booster for WooCommerce plugin up to and including version 8.4.0. Developed by Pluggabl, this widely used extension for the WooCommerce e-commerce platform is now identified as a risk vector. The National Vulnerability Database explicitly describes the technical nature of the defect as an unauthenticated PHP object injection, linking it to the common weakness enumeration identifier CWE-502.

What we know

The National Vulnerability Database lists CVE-2026-42718 as a critical severity vulnerability with a CVSS score of 9.8. This score reflects the high impact and low complexity required to exploit the flaw, as it does not require any form of authentication. The weakness is categorised under CWE-502, which relates to PHP object injection attacks. This classification indicates that the application likely deserialises untrusted data, allowing an attacker to manipulate object states.

Affected software includes the Booster for WooCommerce plugin, specifically versions up to 8.4.0. The vendor, Pluggabl, has released this plugin for use with the WooCommerce platform, a popular e-commerce solution for WordPress sites. The presence of this flaw in versions up to 8.4.0 means that any installation running these or earlier versions is potentially vulnerable to exploitation.

The source material from the National Vulnerability Database provides a concise description: "Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions." There is no mention of active exploitation in the wild within the provided records, nor is there any information regarding a confirmed patch or fix released by the vendor. The absence of a stated remediation in the source material means that no official update has been confirmed yet.

Defender's checklist

• Verify the current version of the Booster for WooCommerce plugin on all managed WordPress installations.
• Cross-reference installed versions against the affected range, which includes version 8.4.0 and all prior releases.
• Identify any unauthenticated endpoints that might interact with the plugin’s data handling functions.
• Monitor server logs for unusual PHP execution patterns or unexpected object instantiation events.

What to do and how to stay safe: Booster for WooCommerce

• Review access controls for any interfaces that process serialised data from external users.
• Implement strict input validation to ensure that only expected data structures are accepted by the application.
• Restrict network access to the affected application components until a verified update is available from the vendor.
• Enable detailed logging for PHP execution errors to detect potential injection attempts early.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Booster for WooCommerce are vulnerable to CVE-2026-42718?

Versions up to and including 8.4.0 are affected by this critical PHP object injection vulnerability.

What is the severity rating for CVE-2026-42718?

The National Vulnerability Database rates this vulnerability as critical with a CVSS score of 9.8.

Is there a patch available for this vulnerability?

No fix has been confirmed yet in the provided source material from the National Vulnerability Database.