CVE-2026-42716— WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
Quick assessment
Affected
payever Payever - WooCommerce Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
未认证 PHP 对象注入漏洞存在于 Payever - WooCommerce 网关插件版本 <= 4.8.2 中。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| payever | Payever - WooCommerce Gateway | n/a≤ 4.8.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42716
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| payever | Payever - WooCommerce Gateway | n/a ~ 4.8.2 | - |
|
II. Public POCs for CVE-2026-42716
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42716
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42716 (1)
IV. Related Vulnerabilities
Same weakness: CWE-502
-
CVE-2026-109361
MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nn -
CVE-2026-109360
MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Ov -
CVE-2026-109237
Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Lea -
CVE-2026-109391
Square Squash through commit e73f280 Unauthenticated YAML De -
CVE-2026-12613
Insecure Deserialization Leading to Remote Code Execution in
V. Comments for CVE-2026-42716
No comments yet