CVE-2026-84099: wpstorecart WordPress Plugin RCE Vulnerability

CVE-2026-84099 Overview

CVE-2026-84099 is an unauthenticated PHP Object Injection vulnerability in the WPStoreCart WordPress plugin through version 5.0.7. The plugin ships a bundled add-on that deserializes user-supplied input without restricting permitted classes. Unauthenticated attackers can reach this endpoint directly and inject arbitrary PHP objects into the application. When a suitable gadget chain exists on the target site, this primitive can escalate to remote code execution, file operations, or data tampering. The flaw is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated attackers can inject arbitrary PHP objects into WordPress sites running WPStoreCart, potentially leading to full site compromise when combined with a gadget chain from WordPress core, other plugins, or themes.

Affected Products

WPStoreCart WordPress plugin, all versions through 5.0.7
WordPress sites bundling the vulnerable WPStoreCart add-on
Any deployment exposing the affected add-on endpoint to the public internet

Discovery Timeline

2026-09-12 - CVE-2026-84099 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-84099

Vulnerability Analysis

The vulnerability resides in a bundled add-on shipped with the WPStoreCart plugin. The add-on accepts serialized data from HTTP requests and passes it to PHP's unserialize() function without validating the request source or constraining the classes that may be instantiated.

Because the endpoint does not enforce authentication or capability checks, any remote user can trigger deserialization. Attackers submit a crafted serialized payload, which PHP reconstructs into live objects. If the site loads a class that implements magic methods such as __wakeup(), __destruct(), or __toString() in a way that performs sensitive operations, the attacker gains a foothold. The complexity rating reflects the dependency on a suitable gadget chain being present in WordPress core, active plugins, or themes.

Root Cause

The root cause is unsafe deserialization of attacker-controlled input [CWE-502]. The bundled add-on does not use the allowed_classes option available in modern PHP unserialize() calls, nor does it substitute a safe format such as JSON. The missing authentication check on the entry point compounds the deserialization flaw by removing any barrier to reaching the vulnerable sink.

Attack Vector

Exploitation occurs entirely over the network. An attacker sends an HTTP request to the exposed add-on endpoint with a serialized PHP object payload in a parameter that reaches unserialize(). When the payload is deserialized, gadget chains present in the WordPress environment execute chosen method sequences. Typical outcomes include arbitrary file writes, arbitrary file deletion, SQL query manipulation, or remote code execution, depending on the available gadgets. Refer to the WPScan Vulnerability Report for technical specifics of the vulnerable endpoint.

Detection Methods for CVE-2026-84099

Indicators of Compromise

HTTP requests to WPStoreCart add-on endpoints containing serialized PHP payloads beginning with patterns such as O:, a:, or s: in query strings or POST bodies
Unexpected PHP files created under wp-content/uploads/ or plugin directories following requests to the add-on
WordPress wp_options or wp_users rows modified without corresponding administrator activity
Outbound network connections initiated by the PHP worker process to unfamiliar hosts shortly after add-on traffic

Detection Strategies

Inspect web server access logs for POST or GET requests to WPStoreCart add-on paths containing serialized object markers
Deploy WAF rules that block request parameters matching PHP serialization signatures targeting the plugin path
Monitor PHP error and warning logs for __wakeup or unserialize notices originating from the plugin directory

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, particularly wp-content/plugins/ and wp-content/uploads/
Forward web server, PHP-FPM, and WordPress audit logs to a centralized analytics platform for correlation
Alert on new administrator account creation and privilege changes within WordPress that lack a legitimate source IP

How to Mitigate CVE-2026-84099

Immediate Actions Required

Update the WPStoreCart plugin to a version released after 5.0.7 that addresses the deserialization flaw once available
Disable or remove the WPStoreCart plugin if a patched version is not yet published for your deployment
Restrict public access to the vulnerable add-on endpoint at the web server or WAF layer
Review recent access logs and WordPress audit trails for signs of exploitation attempts

Patch Information

At the time of publication, no fixed version is listed in the NVD entry beyond confirmation that 5.0.7 and prior are affected. Monitor the WPScan Vulnerability Report for the vendor's remediated release and apply it as soon as it is available.

Workarounds

Block requests to the WPStoreCart add-on endpoint using WAF rules or web server location restrictions until a patch is applied
Deploy a WAF signature that rejects request parameters containing PHP serialization tokens such as O: followed by a digit and a class name
Restrict access to the WordPress site by source IP where practical, particularly for administrative and plugin endpoints
Audit installed plugins and themes to reduce the availability of gadget chains that could be abused during deserialization

bash

# Example NGINX rule to block the vulnerable add-on path until patched
location ~* /wp-content/plugins/wpstorecart/.*/addon\.php$ {
    deny all;
    return 403;
}