Payever WooCommerce Gateway Flaw Lets Attackers Inject PHP Objects Without Login

The Payever WooCommerce Gateway plugin contains a critical security flaw that allows unauthenticated users to inject PHP objects into the application. This vulnerability, identified as CVE-2026-42716, affects all versions of the plugin up to and including version 4.8.2. The flaw exposes any WordPress site using this specific payment gateway to potential remote code execution and data compromise.

Security researchers and the National Vulnerability Database have assigned a CVSS score of 9.8 to this issue, classifying it as critical. The weakness stems from improper neutralization of special elements, specifically categorized under CWE-502. Because the attack requires no authentication, threat actors can exploit the vulnerability from the internet without needing valid login credentials for the WordPress administrator account.

Context and Technical Background

The core of this vulnerability lies in how the plugin handles serialized PHP data. When the application fails to properly validate or sanitize incoming data, it allows an attacker to inject arbitrary PHP objects. This type of PHP object injection can lead to severe consequences, including remote code execution, where an attacker can run malicious commands on the server.

The lack of authentication requirements makes this flaw particularly dangerous for e-commerce sites. Unlike vulnerabilities that require a logged-in user, this issue can be triggered by anyone who can reach the plugin’s endpoint. This broadens the attack surface significantly, allowing automated scanners or targeted attackers to probe for the vulnerability without any prior access to the site.

Who Is Affected

Any WordPress site using the Payever WooCommerce Gateway plugin is potentially affected if it runs version 4.8.2 or any earlier release. This includes a wide range of online stores that rely on Payever for payment processing. Site administrators who have not updated their plugins since the release of version 4.8.2 are currently exposed to this critical risk.

Users of newer versions, if any exist beyond 4.8.2, may be safe, but the National Vulnerability Database record specifically highlights versions up to 4.8.2 as affected. Therefore, identifying the current version of the plugin on any WordPress installation is the first step in determining exposure. Sites that have removed the plugin are not affected by this specific CVE.

Our take on the response

The severity of this unauthenticated flaw demands immediate attention from site administrators. With a CVSS score of 9.8, the potential for damage is extensive. While no patch has been confirmed in the provided source material, the standard response to such a critical finding is to review plugin versions immediately.

Administrators should verify their current plugin version against the affected list. If the site is running version 4.8.2 or lower, it is vulnerable until a secure update is applied. Monitoring vendor announcements for a patched version is essential. In the interim, limiting access to the WordPress admin area and ensuring strong security headers can provide some mitigation, though they do not fix the underlying injection flaw.

Background: CVSS score

The Common Vulnerability Scoring System (CVSS) assigns a numerical score from 0.0 to 10.0 to software vulnerabilities. It calculates this number by weighing factors like attack complexity, required privileges, and impact on confidentiality, integrity, and availability. You use the score to compare the severity of different flaws, but you must adjust for your own context to prioritize fixes correctly.

Read the full guide: How CVSS Scores Work: The Math Behind Vulnerability Ratings

What to do and how to stay safe: Payever

• Check your WordPress plugin list to identify the exact version of the Payever WooCommerce Gateway currently installed on your site.
• If you are running version 4.8.2 or older, isolate the site from the internet or restrict access to trusted IPs while waiting for a vendor update.
• Monitor the Payever developer blog and WordPress plugin repository for an official security patch that addresses CVE-2026-42716.
• Review server logs for any suspicious activity or unusual requests to the plugin’s endpoints that may indicate an attempted exploitation.

Step-by-step guide: Vulnerability Prioritization for Small Businesses

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-42716?

CVE-2026-42716 is a critical vulnerability in the Payever WooCommerce Gateway plugin that allows unauthenticated PHP object injection.

Which versions of the plugin are affected?

All versions of the Payever WooCommerce Gateway plugin up to and including version 4.8.2 are affected by this vulnerability.

Is authentication required to exploit this flaw?

No, the vulnerability allows attackers to inject PHP objects without any form of authentication or valid user credentials.