CVE-2026-1235 — WP eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection
The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitabl…
Published: 2026-02-11 · CVSS: 6.5 · CVSS 3.1
The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7