CVE-2026-84099: Unknown Wpstorecart

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

Affected products

• Unknown Wpstorecart: up to and including 5.0.7

Published 2026-09-12. Last modified 2026-09-14.