PT-2026-7487 · WordPress · Wp Ecommerce

Published 2026-02-11 · Updated 2026-02-11 · CVE-2026-1235

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP eCommerce versions through 3.15.1

Description The WP eCommerce WordPress plugin is affected by an issue where it unserializes user input through AJAX actions. This could allow unauthenticated users to perform PHP Object Injection if a suitable gadget is present. The ajax actions are the entry point for this issue. The vulnerable component processes user-supplied data without proper sanitization, leading to the potential for arbitrary code execution.

Recommendations Update WP eCommerce to a version beyond 3.15.1. Disable the plugin until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-1235

Affected Products

Wp Ecommerce

References · 5

• 🔥 https://wpscan.com/vulnerability/c7eb234e-3113-40db-a00d-358604d91e3f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1235 · Security Note
• https://t.me/cveNotify/151662 · Telegram Post
• https://t.me/CVEtracker/44380 · Telegram Post
• https://twitter.com/VolerionSec/status/2021469134450499772 · Twitter Post