Key points
- The vulnerability is rated CVSS 9.8, which is the highest possible severity score.
- It affects all versions of the Booster for WooCommerce plugin up to and including version 8.4.0.
- The flaw allows unauthenticated PHP object injection, meaning no login credentials are required to exploit it.
Security researchers have identified a severe vulnerability in the Booster for WooCommerce plugin that could allow attackers to take control of affected websites. The issue, tracked as CVE-2026-42718, stems from improper handling of serialized data within the application’s codebase. According to the National Vulnerability Database, this flaw is rated 9.8 on the Common Vulnerability Scoring System, placing it in the critical severity category.
By the numbers
- 9.8 is the CVSS score assigned to CVE-2026-42718, indicating a critical level of risk.
- 8.4.0 is the highest version of the Booster for WooCommerce plugin currently known to be affected.
- CWE-502 is the Common Weakness Enumeration identifier for the PHP object injection weakness involved.
What the figures mean
A CVSS score of 9.8 signals that the vulnerability is easily exploitable and can cause significant damage to the affected system. In this case, the high score reflects the fact that an attacker does not need any authentication to trigger the exploit. This means anyone on the internet, without needing a user account or password, can send a malicious request to a vulnerable site. The underlying weakness, classified as CWE-502, involves PHP object injection. This occurs when an application deserializes untrusted data without proper validation, allowing an attacker to inject arbitrary objects that can execute code on the server.
What to watch
The primary risk here is remote code execution. Because the flaw is unauthenticated, automated scanning tools or malicious bots can discover and exploit it rapidly. Attackers could potentially install malware, steal sensitive customer data, or deface the website. Since Booster for WooCommerce is a popular extension for online stores, the attack surface is broad. Site administrators should monitor their server logs for unusual activity, particularly requests that involve serialized data strings. Any unexpected behavior or new files appearing on the server should be investigated immediately.
What to do and how to stay safe: Booster for WooCommerce
- Check your WooCommerce installation to see if the Booster plugin is active and if its version is 8.4.0 or older.
- Review server access logs for suspicious requests that may indicate attempts to exploit the object injection flaw.
- Ensure your web application firewall is configured to block malicious payloads associated with PHP object injection.
- Wait for an official update from the vendor before making changes, and apply it as soon as it becomes available.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-42718?
CVE-2026-42718 is a critical security vulnerability in the Booster for WooCommerce plugin that allows unauthenticated PHP object injection.
Which versions of the plugin are affected?
All versions of the Booster for WooCommerce plugin up to and including version 8.4.0 are affected by this vulnerability.
Is authentication required to exploit this flaw?
No, the vulnerability is unauthenticated, meaning attackers do not need to log in or have any credentials to exploit it.
