CVE-2026-94568: WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

Q: Which deployments are affected?

Pay with Vipps for WooCommerce versions through 6.2.0 are affected. The provided data does not identify a fixed version or any unaffected configuration.

Q: What level of access does an attacker need?

The vector indicates network-reachable exploitation with low attack complexity, no user interaction, and high privileges required. The data does not specify which WordPress or plugin privilege level satisfies that requirement.

Q: What is the potential impact if exploited?

The issue is rated high severity with high impact to confidentiality, integrity, and availability. It is described as PHP object injection caused by deserialization of untrusted data.

Published Oct 9, 2026

Updated

Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.

Affected Software

1 affected component

WP Hosting AS Pay with Vipps for WooCommerce<=6.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pay with Vipps for WooCommerce to a version that resolves this vulnerability.
Fixed in 6.2.1

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Pay with Vipps for WooCommerce versions through 6.2.0 are affected. The provided data does not identify a fixed version or any unaffected configuration.

What level of access does an attacker need?

The vector indicates network-reachable exploitation with low attack complexity, no user interaction, and high privileges required. The data does not specify which WordPress or plugin privilege level satisfies that requirement.

What is the potential impact if exploited?

The issue is rated high severity with high impact to confidentiality, integrity, and availability. It is described as PHP object injection caused by deserialization of untrusted data.

CVE-2026-94568: WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the potential impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the potential impact if exploited?