External risk intelligence

Novalnet Payment Gateway for WooCommerce PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-57677

The vulnerability exists in a payment gateway plugin for WooCommerce. Payment gateways are designed to be public-facing to process transactions from internet users, making this component inherently accessible and reachable via the public internet in standard e-commerce deployments.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used payment gateway plugin for WooCommerce. This issue, known as unauthenticated PHP object injection, could allow an attacker to compromise the integrity and availability of systems processing online payments, with significant potential for unauthorized access and data manipulation.

Unauthenticated code injection in a payment plugin.
Affects customer trust and payment processing integrity.
Confirm relevance to protect payment systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a PHP object injection vulnerability in the Novalnet Payment Gateway for WooCommerce. This allows an attacker to inject malicious PHP objects into the application, potentially leading to arbitrary code execution or other severe consequences.

No authentication required.
Injecting crafted PHP objects.
Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

This unauthenticated PHP Object Injection vulnerability could impact systems running the Novalnet Payment Gateway for WooCommerce when processing specific serialized data. This may lead to the execution of arbitrary code or data manipulation.

System data and integrity could be affected.
Malicious serialized objects could be injected.
Unauthorized code execution or data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Novalnet Payment Gateway for WooCommerce, being a public-facing plugin for online transactions, likely falls under the responsibility of e-commerce platform owners, application administrators, and potentially the vendor management team for coordination with Novalnet. The initial step should be to confirm the presence of this plugin, assess its exposure and criticality within the business, and identify the designated owner for remediation planning.

E-commerce platform owners/administrators.
Verify plugin presence and external reachability.
Plan vendor-coordinated remediation or temporary mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Novalnet Payment Gateway for WooCommerce?

It is a WordPress plugin facilitating payment processing between e-commerce stores and the Novalnet financial service. It serves as the infrastructure for handling transactions, including credit card and direct debit processing, within the WooCommerce ecosystem.

How is the vulnerability in CVE-2026-57677 classified?

The issue is classified as CWE-502, which denotes deserialization of untrusted data. This PHP object injection flaw occurs when the software processes serialized objects from users without proper validation, potentially allowing unintended object instantiation.

Which conditions must be met to trigger the object injection?

The vulnerability is reachable when an attacker sends crafted serialized data to the plugin. Exploitation does not require authentication and is not limited by a change in scope, meaning the vulnerability remains within the context of the affected plugin's environment.

Why is this vulnerability highly relevant for e-commerce sites?

According to the Halo Surface Signal, this component is inherently public-facing to process internet traffic, making it easily reachable. Because it sits at the intersection of public user interaction and payment handling, it is considered very likely to be targeted.

What steps should administrators take to manage this risk?

Owners should first inventory their systems to confirm if the affected plugin version is active. Once identified, administrators must coordinate with the vendor or follow official security guidance to remediate the plugin's susceptibility to serialized data input.

References

patchstack.com/database/wordpress/plugin/woocommerce-novalnet-gatewa…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.