payever WooCommerce Gateway: Unauthenticated PHP Object Injection

Summary

The payever WooCommerce Gateway WordPress plugin up to and including version 4.8.2 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted input to the plugin without logging in, which may allow manipulation of server-side processing and, depending on the site's code and installed components, arbitrary code execution. The plugin handles checkout and payment flows, so customer data and payment processing could be affected on a WooCommerce shop. CVSS 3.1 is 9.8 (critical); the vendor has not confirmed a fix.

Affected

• payever WooCommerce Gateway WordPress plugin, versions up to and including 4.8.2 (Patchstack lists <= 4.9.0 as vulnerable)

Fixed in

• Unknown. Sources conflict: one reports 4.8.3 or later, another reports no patch available. No vendor advisory was found.

Workaround

• Deactivate the plugin or disable the payment method until a verified fixed version is installed.
• Enable WordPress plugin auto-updates where suitable.
• Virtual patching at the WAF may be possible; no vendor-specific rule was found.

Exploitation

• No evidence of exploitation in the wild found; CISA ADP lists Exploitation: none and the CVE is not in the KEV list.
• No public proof of concept found in the checked sources; this does not rule one out.
• CISA SSVC marks the issue as automatable with total technical impact.

Our recommendation

• Inventory all WordPress/WooCommerce sites and check whether the payever plugin is installed and which version.
• If version 4.8.2 or earlier is installed and no verified fix exists, deactivate the plugin or the payment method.
• Check the vendor changelog and Patchstack page regularly and verify any fix before updating.
• Review web server and WAF logs for suspicious requests to the plugin endpoints; check for unexpected files or admin accounts.
• Create a fresh backup before any change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• SentinelOne vulnerability database www.sentinelone.com
• OpenCVE CVE-2026-42716 app.opencve.io
• Vulners CVE-2026-42716 vulners.com
• HOL Guard CVE-2026-42716 hol.org
• WordPress.org plugin page wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:42.