CVE-2026-62130: WooCommerce Multilingual PHP Injection Flaw

CVE-2026-62130 Overview

CVE-2026-62130 is a PHP Object Injection vulnerability in the WooCommerce Multilingual & Multicurrency plugin for WordPress, affecting versions up to and including 5.5.8. The flaw allows an authenticated user with Shop Manager privileges to inject arbitrary PHP objects through unsafe deserialization of untrusted input. Successful exploitation can lead to full compromise of the WordPress site, including code execution, data tampering, and service disruption. The weakness is categorized as [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Authenticated Shop Managers can inject malicious serialized PHP objects that trigger gadget chains, enabling arbitrary code execution and full site takeover.

Affected Products

WooCommerce Multilingual & Multicurrency plugin for WordPress
Versions <= 5.5.8
WordPress deployments running the affected plugin with Shop Manager accounts

Discovery Timeline

2026-10-10 - CVE-2026-62130 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-62130

Vulnerability Analysis

The vulnerability resides in the WooCommerce Multilingual & Multicurrency plugin's handling of serialized input. The plugin passes attacker-controlled data to a PHP deserialization routine without validating or restricting the object types that can be instantiated. When PHP deserializes a crafted payload, it reconstructs arbitrary objects and invokes magic methods such as __wakeup() or __destruct().

If a suitable gadget chain exists within WordPress core, WooCommerce, or any installed plugin, the attacker can pivot from object instantiation to code execution, file writes, or database manipulation. The attacker requires Shop Manager privileges, which limits mass exploitation but remains realistic in multi-user commerce environments.

Root Cause

The root cause is unsafe use of PHP's unserialize() function against input influenced by an authenticated user. The plugin does not enforce an allow-list of permitted classes using the allowed_classes option introduced in PHP 7. Any serialized payload accepted by the vulnerable endpoint is reconstructed as live PHP objects, inheriting the privileges of the web server process.

Attack Vector

An attacker who has obtained Shop Manager credentials, through phishing, credential stuffing, or insider access, submits a serialized PHP object payload to a vulnerable plugin entry point over HTTP. The server deserializes the payload, triggering gadget chains that execute attacker-chosen operations. Because the attack is network-based and requires no user interaction beyond the attacker's own session, it can be scripted and executed remotely once valid credentials are available.

No verified public proof-of-concept code is available at the time of publication. Refer to the Patchstack advisory for WooCommerce Multilingual for technical details.

Detection Methods for CVE-2026-62130

Indicators of Compromise

HTTP POST requests from Shop Manager accounts containing serialized PHP patterns such as O: followed by a class name and length (for example O:8:"stdClass").
Unexpected PHP files, webshells, or scheduled tasks created under the WordPress document root following plugin activity.
New or modified administrator accounts, options rows, or WooCommerce settings written shortly after suspicious plugin requests.

Detection Strategies

Inspect web server and WordPress audit logs for requests to WooCommerce Multilingual endpoints containing serialized object markers.
Monitor for anomalous use of Shop Manager accounts, especially outside of normal business hours or from unfamiliar IP addresses.
Deploy a web application firewall (WAF) rule to flag request bodies and query strings that match PHP serialization grammar.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/ and wp-content/uploads/ to catch dropped payloads.
Centralize WordPress, PHP, and web server logs in a SIEM and correlate Shop Manager activity with filesystem and database changes.
Track outbound connections from the web server to detect command-and-control traffic initiated by injected objects.

How to Mitigate CVE-2026-62130

Immediate Actions Required

Update WooCommerce Multilingual & Multicurrency to a version later than 5.5.8 as soon as the vendor patch is available.
Audit all Shop Manager and higher-privileged WordPress accounts; disable unused accounts and rotate credentials.
Enforce multi-factor authentication (MFA) for all WordPress administrative and Shop Manager roles.

Patch Information

The vulnerability affects versions <= 5.5.8. Review the Patchstack advisory for WooCommerce Multilingual for the fixed version and vendor remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing plugin files manually.

Workarounds

Temporarily deactivate the WooCommerce Multilingual & Multicurrency plugin until the patched version is deployed.
Restrict access to WordPress administrative endpoints by IP allow-list at the web server or WAF layer.
Deploy virtual patching rules in a WAF to block request payloads containing PHP serialization syntax targeting the plugin's endpoints.

bash

# Example ModSecurity rule to block PHP object injection payloads
SecRule REQUEST_BODY|ARGS "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:" \
    "id:1026062130,phase:2,deny,status:403,\
    msg:'Possible PHP Object Injection targeting WooCommerce Multilingual (CVE-2026-62130)',\
    tag:'CWE-502'"