External risk intelligence

Payever WooCommerce Gateway PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-42716

This vulnerability affects a WooCommerce payment gateway plugin. Such plugins are designed to integrate directly with public-facing e-commerce web applications to process online payments, making them commonly reachable from the internet in standard deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in a payment gateway plugin used with e-commerce platforms, potentially allowing unauthenticated attackers to inject malicious code by exploiting how the system handles certain data inputs. This could impact the integrity and availability of systems processing online payments.

Code injection risk in payment processing.
Affects public-facing e-commerce systems.
Confirm relevance and exposure of payment gateways.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to a website using the affected WooCommerce payment gateway plugin. Because no authentication is required, an unauthenticated attacker can trigger the flaw. This could allow the attacker to inject malicious PHP objects, potentially leading to full system compromise.

No authentication required.
Triggered by a crafted network request.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated PHP Object Injection vulnerability in the Payever WooCommerce Gateway could allow an attacker to execute arbitrary code on a vulnerable system. This could occur when the plugin processes specifically crafted data that is not properly sanitized, potentially impacting the integrity and availability of the affected website and its associated data.

System code execution.
Remote unauthenticated data injection.
Compromise of website and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in a WooCommerce payment gateway plugin impacts e-commerce platforms. The first practical step is to identify all instances of the affected plugin, determine their exposure and business criticality, and then locate the accountable owner for remediation.

Ownership: E-commerce platform or application owner.
Verify first: Plugin presence and public reachability.
Action: Plan vendor coordination for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Payever WooCommerce Gateway plugin?

It is a software component designed for WordPress sites that bridges the gap between an online store and the Payever payment platform. It handles the secure transmission of transaction data, allowing merchants to accept various payment methods through their WooCommerce-powered storefronts.

What does PHP Object Injection mean for CVE-2026-42716?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. It occurs when the plugin takes external, unverified data and converts it back into a PHP object without proper checks. An attacker can craft this input to manipulate the application's logic, potentially leading to unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specifically formatted network request to the web server running the affected plugin. Because the entry point is unauthenticated, the plugin processes the malicious input automatically. Standard, legitimate payment traffic from customers does not trigger this issue, as it requires specially crafted, non-standard input.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-relevance risk because the plugin is designed for public-facing e-commerce applications. Since these gateways must be reachable from the internet to process customer payments, any site running the affected versions is inherently exposed to incoming network requests from unauthorized parties.

What should I do if I use this plugin?

Your first step is to inventory your environment to locate every instance of the Payever WooCommerce Gateway. Once identified, determine which sites are public-facing to prioritize their risk. Coordinate with your team to verify the plugin version and prepare for necessary security updates or configuration changes provided by the vendor.

References

patchstack.com/database/wordpress/plugin/payever-woocommerce-gateway…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.