Booster for WooCommerce: Unauthenticated PHP Object Injection

Summary

Booster for WooCommerce, a WordPress plugin for WooCommerce shops, contains an unauthenticated PHP object injection flaw (CWE-502) in versions up to and including 8.4.0. An unauthenticated remote attacker can manipulate serialized data processed by the plugin, which may allow harmful actions on the server. The CVSS score is 9.8 (critical), and the real impact depends on the code paths and other plugins present on the site.

Affected

• Booster for WooCommerce (package woocommerce-jetpack) up to and including 8.4.0
• Affected range as reported: <= 8.4.0

Fixed in

• Update to 8.5.0 or later (minimum according to the reported fix)
• Current release at time of writing: 8.5.1 (plugin page and GitHub pull request 147)
• Unknown: whether 8.5.0 is the specific fix for this CVE, as no vendor advisory names it

Workaround

• No vendor workaround known.
• If an update cannot be applied immediately, deactivate the plugin or restrict access to it.
• Ask Patchstack whether virtual patching is available.

Exploitation

• CISA SSVC: exploitation none, automatable yes, total technical impact
• Not listed in CISA KEV
• EPSS: not reported
• Public proof of concept: none found
• Patchstack describes the vulnerability as expected to be exploited; no in-the-wild exploitation recorded so far

Our recommendation

• Inventory all WordPress sites (including staging) for the woocommerce-jetpack plugin and record the installed version.
• Update to the current release (8.5.1 at time of writing), treating 8.5.0 as the minimum.
• Confirm the fix with the Patchstack advisory, as no vendor advisory names the CVE.
• Check other plugins and themes on the same sites for unpatched vulnerabilities.
• If the plugin was exposed before patching, review logs for unusual requests to Booster endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress plugin page woocommerce-jetpack wordpress.org
• GitHub pull request 147 pluggabl/woocommerce-jetpack github.com
• GitHub Advisory GHSA-3777-f2vm-752j github.com
• CVEMon CVE-2026-42718 cvemon.intruder.io
• OpenCVE CVE-2026-42718 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:43.