PT-2026-42100 · WordPress · Boost

Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-7637

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Boost plugin for WordPress versions prior to 2.0.4

Description The plugin is subject to PHP Object Injection due to the deserialization of untrusted input. Unauthenticated remote attackers can inject a PHP Object by passing a manipulated string through the STYXKEY-BOOST USER LOCATION cookie. This issue requires a Property-Oriented Programming (POP) chain—a sequence of gadgets (existing code snippets) used to achieve a specific goal—to be present in another installed plugin or theme to have an impact. If such a chain exists, it may allow the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to version 2.0.4. As a temporary workaround, restrict or sanitize the STYXKEY-BOOST USER LOCATION cookie to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-7637

Affected Products

Boost

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7637 · Security Note
• https://pixelyoursite.com/boost-plugin · Note
• https://twitter.com/UpwindMDR/status/2057031801852346713 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e391f560-2037-4180-a77e-1731524a318c?source=cve · Note
• https://twitter.com/CVEnew/status/2056994205881496004 · Twitter Post