CVE-2026-62130

Executive Summary

CVE-2026-62130 is a PHP Object Injection vulnerability (CWE-502) affecting WooCommerce Multilingual & Multicurrency versions 5.5.8 and earlier. The flaw resides in the plugin's "shop manager" code path: a user holding the shop manager role can supply crafted serialized PHP data that is deserialized by the plugin, enabling object injection. Successful exploitation allows an authenticated attacker with shop manager privileges to achieve high confidentiality, integrity, and availability impact (CVSS 7.2), potentially culminating in remote code execution via PHP magic methods (__wakeup, __destruct) chained against installed gadget classes. The plugin is UNPATCHED and no public PoC or Nuclei template exists at time of writing.

Technical Analysis

The vulnerability is a PHP Object Injection (POI) issue, categorized under CWE-502 ("Deserialization of Untrusted Data"). The NVD description states: "Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions."

WooCommerce Multilingual & Multicurrency (WCML) is the official WPML add-on that extends WooCommerce's storefront with translation and currency-switching functionality. It exposes custom capability surfaces to the WooCommerce shop_manager role, including product editing, price management, and store settings. The vulnerable code path accepts a serialized PHP value from a request originating from a shop manager context and passes it to PHP's native deserialization routine (unserialize()).

The precise parameter, function, or endpoint that receives the serialized input is not disclosed in the available CVE data; the NVD description does not name the affected function, class, hook, or file path. What is derivable is the vulnerability class:

• Attack vector over the network (AV:N) — the flaw is reachable via HTTP requests to the WordPress installation.
• Low attack complexity (AC:L) — no unusual race conditions or pre-conditions beyond authentication are required.
• High privileges required (PR:H) — the attacker must already hold the shop_manager role (or an equivalent capability grant on the WCML surface). This is the primary reason the base score is 7.2 rather than critical.
• No user interaction (UI:N) — no victim needs to click a link or open a file.
• Scope unchanged (S:U) — compromise is contained within the WordPress/PHP application context.
• High CIA (C:H/I:H/A:H) — object injection in PHP frequently enables arbitrary file operations, database access, and code execution through gadget chains already present in loaded plugins/theme/library autoloaders.

PHP object injection is dangerous even without a direct unserialize() RCE primitive because PHP's magic methods (__wakeup, __destruct, __toString, __call) are invoked automatically during object lifecycle events. An attacker who controls the serialized byte stream can instantiate any class already loaded in the PHP process — including classes provided by WCML itself, WPML core, WooCommerce, or any co-installed plugin/theme — and steer the resulting method calls into dangerous sinks (file writes, call_user_func, query construction, etc.). Because WCML is a WooCommerce-ecosystem plugin, the population of autoloadable classes on a typical store is large, expanding the gadget surface considerably.

The plugin's "shop manager" gating means this is not an internet-wide opportunistic bug: it requires an actor with at least store-staff-level credentials. However, shop manager accounts are routinely assigned to fulfillment, support, or marketing staff, and are a common target of credential-stuffing, phishing, and insider abuse. Once such an account is compromised, CVE-2026-62130 becomes a privilege-escalation and lateral-move primitive from "store staff" to "arbitrary PHP object invocation," which in the WordPress ecosystem very often means site administrator or full server compromise.

No information is available in the provided intelligence to identify the exact injection parameter, the exact unserialize sink, or a specific gadget chain. Analysts should treat the mechanism as: authenticated shop-manager → crafted serialized payload into a plugin endpoint → unserialize() → magic-method-driven side effects → RCE/file-inclusion/SQL impact depending on available gadgets.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (PHP Object Injection / CWE-502) and the CVSS vector. No specific function names, endpoints, or parameters are fabricated because the NVD description does not disclose them.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running WooCommerce plus the WooCommerce Multilingual & Multicurrency plugin at version 5.5.8 or earlier. Fingerprinting is achievable by requesting known WCML static asset paths (e.g., plugin directory assets referenced in page source, woocommerce-multilingual strings in HTML/JS) or via Shodan/FOFA/Google dorking on the plugin slug. The attacker needs to know which version is installed, typically by inspecting asset query strings or readme files exposed by the web server.

2. Credential acquisition for the shop manager role. Because PR:H is set, the attacker must first obtain shop-manager-level access. Realistic vectors include credential stuffing against /wp-login.php, phishing store staff, abuse of stale/contractor accounts, or lateral movement from another compromised plugin that grants role manipulation. The attacker logs in and reaches the admin/store-management area where WCML exposes its settings and operations.

3. Triggering the flaw class. From an authenticated shop-manager session, the attacker submits a request that carries a serialized PHP value into the vulnerable code path. In a POI vulnerability the payload is a string produced by serialize(), typically recognizing a class name via O:<len>:"ClassName":<n>:{...} syntax, with property values chosen to drive behavior on wakeup/destruction. The exact request parameter, POST field name, and endpoint are not published in the CVE data. What is known: the injected value reaches PHP's native deserialization routine in the WCML plugin while processing a shop manager action.

4. Gadget chain execution. If a usable gadget chain is available among classes loaded by WordPress, WooCommerce, WPML/WCML, or any co-installed plugin/theme, the deserialized object's magic methods fire and invoke sinks such as file writes, dynamic function calls, or SQL construction. Where no chain exists, the impact is reduced but still includes arbitrary object instantiation, type confusion, and potential denial of service.

5. Post-exploitation impact. On a successful chain, outcomes typically include: writing a PHP webshell into the WordPress webroot, injecting malicious admin users, exfiltrating the wp-config.php database credentials, or pivoting to other sites on shared hosting. Even short of RCE, the CVSS C:H/I:H/A:H rating reflects that confidentiality, integrity, and availability of the store — customers, orders, and payment-adjacent data — can all be affected.

The combination of PR:H, AV:N, AC:L, and no public exploit currently constrains this to actor classes that already possess or can obtain a shop manager account (insider, compromised-staff, credential-purchasing). It is nonetheless a high-severity post-authentication escalation primitive that should be treated as patch-pending-critical.

Impact Assessment

Business impact for a WooCommerce store running WCML ≤ 5.5.8 is significant:

• Confidentiality (High). Customer PII, order history, addresses, partial payment metadata, and (depending on gadget reach) database credentials and API keys may be exposed. WooCommerce stores are subject to PCI DSS scoping; a compromise of order data can trigger breach notification and forensic obligations.
• Integrity (High). An object-injection primitive often permits persistent modification — plugin/theme file writes, injected admin users, modified prices, manipulated order records, or SEO spam injection across the storefront.
• Availability (High). A malformed or destructive gadget can crash the PHP worker, corrupt tables, or take the store offline (revenue loss per minute during peak sale periods).

Blast radius. The immediate blast radius is limited to the individual WordPress installation and its database, but because the vector is AV:N, one compromised shop-manager account can be used at scale across many sites in a hosting or agency fleet where the role is provisioned identically. Multi-tenant hosts and managed WordPress platforms supporting WCML should treat this as fleet-wide exposure.

CVSS subscore rationale. AV:N — reachable over HTTP; AC:L — no special conditions; PR:H — shop manager role required; UI:N — no victim action; S:U — impact confined to the vulnerable component's security authority; C:H/I:H/A:H — full impact to confidentiality, integrity, and availability. EPSS is not yet assigned by FIRST.org; CISA KEV listing is absent as of the data provided.

Who is affected. Any WordPress site with an active/active-on-frontend install of WooCommerce Multilingual & Multicurrency at version ≤ 5.5.8, where shop manager accounts exist or can be created. Sites that have uninstalled, disabled, or are running 5.5.9+ (if/when available) are out of scope for this CVE.

Detection Guidance

Detection is challenging because the vulnerability fires inside PHP deserialization; network and host telemetry must be combined. Because the exact parameter name and endpoint are unpublished, rules below use broad-but-defensible signals: presence of serialized-PHP markers in HTTP requests to WordPress admin endpoints, WCML asset paths, and anomalous shop-manager activity. Tune thresholds to your baseline.

Sigma Rule

title: WooCommerce Multilingual PHP Object Injection Attempt (CVE-2026-62130)
id: 3c9d2e5a-7b41-4f8a-9d21-1b6f0c4e8a77
status: experimental
description: Detects HTTP requests to WordPress admin/AJAX endpoints that carry serialized PHP object markers, indicating possible exploitation of the PHP Object Injection vulnerability in WooCommerce Multilingual & Multicurrency <= 5.5.8 (CVE-2026-62130).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62130
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026-62130
logsource:
  category: webserver
  product: generic
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-admin/admin-post.php'
      - '/wp-admin/options.php'
      - '/wp-json/'
  selection_serialized:
    cs-uri-query|contains:
      - 'O:'
      - 'a%3A'
      - '%22__PHP_Incomplete_Class'
    cs-uri-query|re: 'O:\d+:"[A-Za-z_\\]+":\d+:\{'
  condition: selection_uri and selection_serialized
falsepositives:
  - Legitimate WooCommerce session/serialized data in cookies (filter by cookie header separately)
  - Plugins that pass serialized arrays in query strings (rare; baseline and whitelist)
level: high

YARA Rule

rule CVE_2026_62130_WCML_PHP_Object_Injection
{
    meta:
        author = "Threat Intelligence"
        description = "Detects serialized PHP object payloads targeting WooCommerce Multilingual PHP Object Injection (CVE-2026-62130) in HTTP request bodies and access logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62130"
        date = "2026-01-01"
        severity = "high"
        cve = "CVE-2026-62130"

    strings:
        $s1 = "woocommerce-multilingual" ascii nocase
        $s2 = "woocommerce_multilingual" ascii nocase
        $s3 = "wcml" ascii nocase
        $php_o = /O:[0-9]{1,5}:"[A-Za-z_\\]{2,120}":[0-9]{1,5}:\{/
        $php_a = /a:[0-9]{1,5}:\{/
        $php_wake = "__wakeup" ascii
        $php_dest = "__destruct" ascii
        $php_incl = "__PHP_Incomplete_Class" ascii
        $urlenc_o = "%4F%3A" ascii nocase
        $urlenc_ob = "O%3A" ascii nocase

    condition:
        filesize < 2MB and
        (any of ($s1, $s2, $s3)) and
        (any of ($php_o, $php_a, $urlenc_o, $urlenc_ob, $php_incl)
         or 2 of ($php_wake, $php_dest))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62130 WooCommerce Multilingual PHP Object Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/"; http.request_body; content:"O:"; pcre:"/O:\d{1,5}:\"[A-Za-z_\\\\]{2,120}\":\d{1,5}:\{/U"; reference:cve,2026-62130; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62130; classtype:web-application-attack; sid:90062130; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, attack_target Web_Server, deployment Perimeter, confidence Medium, signature_severity Major, tag cve_2026_62130;)

alert http any any -> any any (msg:"CVE-2026-62130 WooCommerce Multilingual PHP Object Injection via URL-encoded payload"; flow:established,to_server; http.uri; content:"woocommerce-multilingual"|nocase; http.uri; content:"O%3A"; nocase; reference:cve,2026-62130; classtype:web-application-attack; sid:90062131; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, tag cve_2026_62130;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.name : * ]
  [ network where event.action == "http_request"
      and url.path : ("/wp-admin/admin-ajax.php", "/wp-admin/admin-post.php", "/wp-admin/options.php", "/wp-json/*")
      and http.request.body contains "O:" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval qs =coalesce(uri_query, cs_uri_query, "")
| where match(uri, "(?i)/wp-admin/(admin-ajax|admin-post|options|admin)\.php|/wp-json/")
    AND (match(qs, "O%3A\\d+%3A") OR match(qs, "O:\\d+:\"") OR match(qs, "a%3A\\d+%3A") OR match(qs, "O:\\d+:%22")
         OR match(_raw, "(?i)woocommerce-multilingual") )
| stats count min(_time) as first_seen max(_time) as last_seen values(qs) as payloads by src_ip, user
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-62130,">
  <rule id="10062130" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match_type>pcre2</match_type>
    <regex type="pcre2">(?i)(?:/wp-admin/(?:admin-ajax|admin-post|options|admin)\.php|/wp-json/).*(?:O%3A\d+%3A|O:\d+:"|a%3A\d+%3A|__PHP_Incomplete_Class)</regex>
    <description>CVE-2026-62130: Possible WooCommerce Multilingual PHP Object Injection attempt (serialized object in request to WP admin endpoint)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,web_attack,</group>
  </rule>

  <rule id="10062131" level="10">
    <if_sid>10062130</if_sid>
    <match>woocommerce-multilingual</match>
    <description>CVE-2026-62130: PHP Object Injection payload referencing WooCommerce Multilingual asset/path</description>
    <group>attack.initial_access,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch reference, or workaround has been published through any tracked source as of the data provided. Treat the following as interim risk reduction, not a fix.

1) Immediate mitigations (hours):

• Audit shop manager accounts. Enumerate every user with the WooCommerce shop_manager role (and any custom role carrying the same WCML capabilities). Disable dormant, shared, and contractor accounts. Enforce unique credentials and MFA on all store-staff logins to close the PR:H gate.
• Restrict admin surface. Place /wp-admin/ and admin-ajax.php behind an allow-list of trusted IPs or a Zero-Trust access proxy (e.g., Cloudflare Access) so only known staff networks can reach the vulnerable code path.
• Add a WAF rule. Block POST/META requests to WP admin endpoints whose bodies contain serialized-PHP markers (O:<n>:", a:<n>:{, __PHP_Incomplete_Class). This is the fastest compensating control; expect some tuning against benign serialized WooCommerce traffic.
• Alert on the Sigma/Suricata/Wazuh rules above. Enable them now — no public exploit exists, but POI payloads are easy to generate once a gadget is found.

2) Patch / upgrade steps:

• Monitor the WPML/WooCommerce Multilingual release channel and the NVD entry for CVE-2026-62130 for a fixed version. As of writing, none is available; version 5.5.9 or a 5.6.x backport is the likely vector for a fix.
• If WCML is not business-critical, temporarily deactivate the plugin. This fully removes the attack surface. On multi-site, deactivate network-wide.
• If deactivation is not possible, ensure no user other than a very small, MFA-protected set holds the shop manager role until a patch lands.
• Subscribe to the plugin vendor's advisory feed and to WPScan's vulnerability database for CVE-2026-62130; WPScan typically publishes a fixed-version marker (e.g., "Fixed in: 5.5.9") before NVD updates.

3) Long-term hardening:

• Principle of least privilege on store roles. Shop manager grants broad capability; segment it. Frequent reviews, JIT elevation, and no role assignment without justification.
• Disable file editing and harden WP. Set DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS in wp-config.php; run the web user as non-root; enable open_basedir where feasible.
• RASP / PHP hardening. Consider disable_functions for dangerous sinks (system, exec, passthru, shell_exec), a WAF or RASP product that hooks unserialize(), and a PHP version receiving security support.
• Backup and integrity monitoring. Maintain immutable backups and enable WordPress file-integrity monitoring so a gadget-driven webshell write is detected quickly.
• Vulnerability management. Track plugin CVEs (WPScan, Patchstack) and enforce a policy that any WordPress plugin scoring CVSS ≥ 7.0 with an explicit CVE is patched within 72 hours once a fix exists.

References

• NVD — CVE-2026-62130: https://nvd.nist.gov/vuln/detail/CVE-2026-62130
• CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• OWASP — PHP Object Injection: https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
• WooCommerce Multilingual & Multicurrency plugin page (vendor): https://wordpress.org/plugins/woocommerce-multilingual/
• WPScan Vulnerability Database (monitor for fixed-version marker): https://wpscan.com/plugin/woocommerce-multilingual

Threat actor / exploit evidence. No public PoC, Nuclei template, or exploit code is available for CVE-2026-62130 as of this report. The CVE is not listed in CISA KEV. No named threat actor campaign has been tied to this specific CVE in the provided intelligence. Because it is a post-authentication PHP Object Injection requiring only the shop manager role, the realistic near-term exploitation profile is opportunistic abuse by actors who already compromise store-staff credentials (via credential stuffing or phishing), escalating to full site compromise. Monitor WPScan and NVD for the first fixed-version publication and for any PoC appearance.