CVE-2026-84099: IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

Q: What must be present for the issue to have a more serious impact than object injection alone?

A suitable PHP gadget chain must be present on the site for the injected objects to be escalated further. The available information does not identify any specific gadget chain or resulting impact.

Q: Does exploitation require an authenticated WordPress account?

No. The affected bundled add-on can be accessed directly without authentication, and the unsafe deserialization accepts attacker-supplied input.

Q: Which component should be checked when assessing exposure?

Check whether wpStoreCart is installed at version 5.0.7 or earlier and whether its bundled wpsc-membership-pro add-on, including paypal.php, is accessible. The vulnerable behavior is tied to direct access to that bundled add-on.

Published Sep 12, 2026

Updated

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

Affected Software

1 affected component

IDB Ecommerce wpStoreCart<=5.0.7

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What must be present for the issue to have a more serious impact than object injection alone?

A suitable PHP gadget chain must be present on the site for the injected objects to be escalated further. The available information does not identify any specific gadget chain or resulting impact.

Does exploitation require an authenticated WordPress account?

No. The affected bundled add-on can be accessed directly without authentication, and the unsafe deserialization accepts attacker-supplied input.

Which component should be checked when assessing exposure?

Check whether wpStoreCart is installed at version 5.0.7 or earlier and whether its bundled wpsc-membership-pro add-on, including paypal.php, is accessible. The vulnerable behavior is tied to direct access to that bundled add-on.