{
 "id": "WPSEC-2026-2644",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2644/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2644/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2644/index.md",
 "title": "myPOS Checkout <= 1.4.5 - Authenticated (Shop Manager+) PHP Object Injection via Upsells REST Endpoint",
 "description": "The myPOS Checkout plugin for WordPress is vulnerable to PHP Object Injection via the wc/v3/upsells REST endpoint in all versions up to, and including, 1.4.5, due to the endpoint storing non-array values of the base_products and recommended_products fields unchanged, which are later passed to unserialize() and maybe_unserialize() when upsells are looked up on checkout and when they are returned by the REST endpoint. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "mypos-virtual-for-woocommerce",
  "name": "myPOS Checkout",
  "full_name": "myPOS Checkout",
  "wordpress_org": "https://wordpress.org/plugins/mypos-virtual-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mypos-virtual-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mypos-virtual-for-woocommerce"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.6",
 "remediation": "Update to 1.4.6 or later.",
 "fix_released": "2026-11-05T09:44:05+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T11:59:28.211673+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2644/",
  "https://plugins.svn.wordpress.org/mypos-virtual-for-woocommerce/tags/1.4.6/",
  "https://wordpress.org/plugins/mypos-virtual-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mypos-virtual-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}