myPOS Checkout <= 1.4.5 - Authenticated (Shop Manager+) PHP Object Injection via Upsells REST Endpoint
- ID
- WPSEC-2026-2644
- Plugin
- myPOS Checkout (mypos-virtual-for-woocommerce)
- Affected
- all versions before 1.4.6
- Remediation
- Update to 1.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- myPOS Checkout on WPSec AttackSurface
- Fix released
- Published
Description
The myPOS Checkout plugin for WordPress is vulnerable to PHP Object Injection via the wc/v3/upsells REST endpoint in all versions up to, and including, 1.4.5, due to the endpoint storing non-array values of the base_products and recommended_products fields unchanged, which are later passed to unserialize() and maybe_unserialize() when upsells are looked up on checkout and when they are returned by the REST endpoint. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-2644/
- https://plugins.svn.wordpress.org/mypos-virtual-for-woocommerce/tags/1.4.6/
- https://wordpress.org/plugins/mypos-virtual-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS