CVE-2026-1235: 
WordPress vulnerability analysis and mitigation

CVE-2026-1235 is an unauthenticated PHP Object Injection vulnerability in the WP eCommerce WordPress plugin affecting versions through 3.15.1. The plugin improperly unserializes user-supplied input via AJAX actions without authentication, enabling attackers to inject malicious PHP objects when a suitable gadget chain is present on the target site. It was publicly disclosed on January 21, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (WPScan, Red Hat).

The root cause is improper deserialization of untrusted data (CWE-502 / CAPEC-586: Object Injection). The plugin's AJAX handlers — specifically wpsc_update_customer_meta — accept a meta_value parameter that is base64-encoded and then passed directly to PHP's unserialize() function without sanitization or authentication checks. An attacker can craft a malicious serialized PHP object and submit it via a POST request to /wp-admin/admin-ajax.php, targeting the _wpsc_cart.cart_items meta key. Exploitation requires a suitable PHP gadget chain to be present in the WordPress environment (e.g., from another installed plugin or theme), which elevates attack complexity (WPScan, Infinit Sec).

Successful exploitation can lead to arbitrary code execution, unauthorized data access, or denial of service depending on the gadget chain available in the target environment. The CVSS scope is marked as Changed, meaning a successful attack can affect components beyond the vulnerable plugin itself, including the broader WordPress installation and underlying server. Potential consequences include confidentiality loss (data exfiltration), integrity compromise (file modification, backdoor installation), and availability impact (service disruption) (WPScan, Red Hat).

A proof-of-concept demonstrating the injection of a malicious serialized payload via the wpsc_update_customer_meta AJAX action is publicly documented on WPScan (WPScan). The EPSS score is very low at 0.01%, suggesting limited automated exploitation activity at this time. No confirmed in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA KEV catalog. Attack complexity is rated High due to the requirement for a suitable gadget chain (Red Hat).

1. Reconnaissance: Identify WordPress sites running WP eCommerce plugin version ≤ 3.15.1 using tools like WPScan (wpscan --url <target> --enumerate p) or by checking the plugin's readme.txt at /wp-content/plugins/wp-e-commerce/readme.txt.
2. Obtain a session cookie: Access the target site to receive a wpsc_customer_cookie_* session cookie, which is issued to unauthenticated visitors automatically by the plugin.
3. Craft a malicious serialized payload: Identify a suitable PHP gadget chain present in the target environment (e.g., using tools like PHPGGC). Serialize the gadget chain object and base64-encode it.
4. Inject the payload: Send a POST request to /wp-admin/admin-ajax.php with the action wpsc_update_customer_meta, setting meta_key=_wpsc_cart.cart_items and meta_value=<base64-encoded-serialized-payload>, using the obtained session cookie.
5. Trigger deserialization: Send a follow-up POST request with action=wpsc_get_customer_meta&meta=_wpsc_cart.cart_items using the same cookie to retrieve and trigger deserialization of the stored payload.
6. Achieve objective: Depending on the gadget chain, this may result in remote code execution, file write, or other impacts on the server (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=wpsc_update_customer_meta or action=wpsc_get_customer_meta from unauthenticated or unknown IP addresses; base64-encoded values in the meta_value parameter that decode to PHP serialized strings (beginning with a:, O:, s:, etc.).
• Logs: Web server access logs showing repeated AJAX requests to admin-ajax.php with the above actions from the same session cookie but no authenticated user; error logs showing PHP deserialization warnings or unexpected object instantiation.
• File System: Newly created or modified PHP files in the WordPress installation directory (e.g., web shells in wp-content/uploads/ or plugin directories); unexpected .php files with obfuscated content.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) that are not typical for normal WordPress operation (WPScan).

As of the time of disclosure, there is no known fix available for the WP eCommerce plugin (versions ≤ 3.15.1) (WPScan). Site administrators should consider deactivating and removing the plugin until a patched version is released. As a compensating control, deploying a Web Application Firewall (WAF) rule to block or inspect POST requests to admin-ajax.php containing serialized PHP data in parameters can reduce exposure. Minimizing the number of installed plugins and themes reduces the likelihood of a usable gadget chain being present on the site.

The vulnerability was discovered and submitted by researcher Yiğit İbrahim Sağlam (ibrahimsql) and verified by WPScan (WPScan). Security community discussion was noted on Mastodon/Infosec.exchange and tracked by threat intelligence platforms including Vulners, Offseq Radar, and CIRCL. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts referencing the vulnerability (INCIBE).