CVE-2026-57677: Novalnet Payment Gateway For Woocommerce

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

Affected products

• Novalnet Novalnet Payment Gateway For Woocommerce: up to and including 12.10.3

Published 2026-07-02. Last modified 2026-07-02.