CVE-2026-95603: Reycob Product Import Export Object Injection

CVE-2026-95603 Overview

CVE-2026-95603 is a PHP Object Injection vulnerability affecting the Reycob Product Import Export plugin for WordPress in versions 2.3.0 and earlier. The flaw stems from unsafe deserialization of untrusted input handled by users with the Shop Manager role. An authenticated actor with elevated WooCommerce privileges can inject serialized PHP objects that trigger gadget chains present in the WordPress runtime or bundled libraries. Successful exploitation can lead to arbitrary code execution, data tampering, or full site compromise. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
An authenticated Shop Manager can deserialize attacker-controlled PHP objects, enabling code execution and complete compromise of confidentiality, integrity, and availability on affected WordPress sites.

Affected Products

Reycob Product Import Export WordPress plugin, versions <= 2.3.0
WordPress installations running WooCommerce with the Shop Manager role assigned
Any hosting environment where the plugin is active and reachable over the network

Discovery Timeline

2026-09-23 - CVE-2026-95603 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95603

Vulnerability Analysis

The Reycob Product Import Export plugin processes user-supplied input through PHP's unserialize() function without sufficient validation. When a Shop Manager submits crafted data through an affected import or configuration handler, the plugin reconstructs arbitrary PHP objects from that input. If any autoloaded class in the WordPress environment exposes magic methods such as __wakeup() or __destruct() with side effects, those methods execute during deserialization. This gadget-chain pattern is well established in WordPress plugin exploitation and typically leads to file writes, SQL execution, or command execution.

The vulnerability requires high privileges because only the Shop Manager role, or higher, can reach the affected code path. It does not require user interaction and is exploitable over the network through the WordPress admin interface.

Root Cause

The root cause is insecure deserialization of untrusted input, classified as CWE-502. The plugin trusts serialized data supplied through an authenticated request and passes it to unserialize() without a whitelist of allowed classes or an alternative safe format such as JSON.

Attack Vector

An attacker who controls a Shop Manager account, or who has compromised one through credential theft or phishing, submits a crafted payload to a vulnerable endpoint in the plugin. The payload contains a serialized PHP object referencing a class with an exploitable magic method. Upon deserialization, the object triggers a gadget chain that executes attacker-controlled operations under the WordPress process user. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-95603

Indicators of Compromise

Unexpected PHP files or webshells written under wp-content/uploads/ or plugin directories following Shop Manager activity.
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts.
WordPress option or post-meta rows containing serialized payloads with class names not used by the site.
Anomalous admin-ajax or plugin endpoint requests carrying O: or a: prefixed serialized data in POST bodies.

Detection Strategies

Inspect web server access logs for POST requests to Reycob Product Import Export endpoints containing serialized PHP object markers.
Correlate Shop Manager authentication events with subsequent file system changes in the WordPress webroot.
Enable WordPress audit logging to record plugin configuration and import operations performed by non-administrator roles.

Monitoring Recommendations

Alert on new or modified PHP files inside plugin, theme, or upload directories.
Monitor process creation events where the web server user spawns shells or interpreters such as sh, bash, or python.
Track privilege changes and role assignments within WordPress to detect abuse of Shop Manager accounts.

How to Mitigate CVE-2026-95603

Immediate Actions Required

Update the Reycob Product Import Export plugin to a version above 2.3.0 as soon as a patched release is available from the vendor.
Audit all accounts holding the Shop Manager role and remove any that are inactive or unnecessary.
Rotate credentials for all privileged WooCommerce accounts and enforce multi-factor authentication.

Patch Information

At the time of publication, the Patchstack advisory identifies versions <= 2.3.0 as vulnerable. Administrators should consult the plugin's changelog on the WordPress plugin repository and upgrade to the first release that addresses this issue.

Workarounds

Deactivate and remove the Reycob Product Import Export plugin until a fixed version is installed.
Restrict access to WordPress admin URLs by IP allowlist at the reverse proxy or web application firewall.
Deploy a WAF rule that blocks POST requests to plugin endpoints containing serialized PHP object patterns such as O:\d+:".

bash

# Example nginx rule to block serialized PHP object payloads to the plugin
location ~* /wp-content/plugins/reycob-product-import-export/ {
    if ($request_method = POST) {
        if ($request_body ~* "O:[0-9]+:\"") {
            return 403;
        }
    }
}