CVE-2026-7635

Executive Summary

CVE-2026-7635 is a critical unauthenticated PHP Object Injection vulnerability in the WordPress plugin coreActivity: Activity Logging for WordPress (versions up to and including 3.0). The plugin logs HTTP User-Agent headers without sanitization, storing raw serialized PHP data in the logmeta table. When an administrator views the Logs page, the plugin calls maybe_unserialize() on every retrieved meta_value in the query_metas() function, leading to deserialization of attacker-controlled input. This triggers a Fatal TypeError in DeviceDetector::setUserAgent(), causing a persistent Denial of Service (DoS) condition that blocks administrator access to the Logs page. No patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor the plugin page for updates and consider disabling the plugin until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is rated High due to the low attack complexity, no required privileges, and the significant availability impact (persistent DoS). The EPSS score of 0.0% suggests low exploitation likelihood at this time, but the lack of a patch increases risk.

Deep Dive & Mechanics

The coreActivity plugin logs various WordPress events, including failed login attempts. During logging, the plugin captures the HTTP User-Agent header and stores it in the logmeta table without any validation or sanitization. The stored value is later retrieved by the query_metas() function, which calls maybe_unserialize() on every meta_value. This function attempts to unserialize any data that looks like a serialized PHP string.

An attacker can send a crafted User-Agent header containing a PHP serialized payload. When an administrator visits the Logs page, the plugin deserializes this payload and passes it to DeviceDetector::setUserAgent(). The deserialized object, if not a string, causes a Fatal TypeError, crashing the page and preventing the administrator from viewing logs. This condition persists until the malicious entry is removed from the database.

The vulnerability is in the query_metas() function, which does not verify that the data was originally serialized by the application before calling maybe_unserialize().

Vulnerable vs. Patched Code

Vulnerable Code (coreActivity <= 3.0):

// In the logging function, User-Agent is stored directly
$meta_value = $_SERVER['HTTP_USER_AGENT'];
// ... stored in logmeta table

// In query_metas() function
function query_metas() {
    // ...
    foreach ($results as $row) {
        $meta_value = maybe_unserialize($row->meta_value);
        // $meta_value is then passed to DeviceDetector::setUserAgent()
        DeviceDetector::setUserAgent($meta_value);
    }
}

Patched Code (Hypothetical):

// Validate User-Agent before storage
$meta_value = sanitize_text_field($_SERVER['HTTP_USER_AGENT']);

// In query_metas() function
function query_metas() {
    // ...
    foreach ($results as $row) {
        // Only unserialize if the data was serialized by the application
        if (is_serialized($row->meta_value) && $row->meta_key === 'expected_key') {
            $meta_value = maybe_unserialize($row->meta_value);
        } else {
            $meta_value = $row->meta_value;
        }
        // Ensure $meta_value is a string before passing to DeviceDetector
        if (is_string($meta_value)) {
            DeviceDetector::setUserAgent($meta_value);
        }
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with coreActivity plugin <= 3.0 installed and active.
• Network access to the target.

Exploitation Steps:

1. Identify a logged event endpoint (e.g., a failed login attempt).
2. Craft a malicious User-Agent header containing a PHP serialized payload that will cause a Fatal TypeError when deserialized. For example:

   User-Agent: O:1:"X":0:{}
   

   This creates an object of class X (which doesn't exist), causing a TypeError when passed to setUserAgent().
3. Send the request:

   curl -k -X POST 'https://target.com/wp-login.php' \
     -H 'User-Agent: O:1:"X":0:{}' \
     -d 'log=admin&pwd=wrongpassword'
   

4. Wait for an administrator to visit the Logs page (e.g., /wp-admin/admin.php?page=coreactivity-logs).
5. The administrator will see a Fatal Error, and the Logs page will be inaccessible.

Persistent DoS: The malicious entry remains in the database, causing the DoS to persist until the entry is manually removed via database query.

Blue Team

Detection:

• Monitor for unusual User-Agent headers containing PHP serialized data (e.g., O:, a:, s: followed by numbers).
• Alert on failed login attempts with suspicious User-Agent strings.
• Monitor database queries to the logmeta table for unexpected serialized data.

Mitigation:

• Immediately disable the coreActivity plugin if no patch is available.
• Manually remove malicious entries from the logmeta table:

  DELETE FROM wp_coreactivity_logmeta WHERE meta_value LIKE 'O:%';
  

• Implement a Web Application Firewall (WAF) rule to block User-Agent headers containing PHP serialized patterns.
• Restrict access to the Logs page to trusted IPs only.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests with User-Agent headers containing PHP serialized strings (e.g., O:, a:, s:).
  • Failed login attempts to /wp-login.php with suspicious User-Agent values.

• Host:

  • Database entries in wp_coreactivity_logmeta where meta_value contains PHP serialized data.
  • PHP Fatal Error logs referencing DeviceDetector::setUserAgent() and TypeError.

• File:

  • No specific file IOCs; the attack is purely data-driven.

Detection Engineering

YARA Rule

rule CVE_2026_7635_UserAgent_Serialized {
    meta:
        description = "Detects PHP serialized payloads in User-Agent headers targeting coreActivity plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-7635"
    strings:
        $serialized = /[Oa]:\d+:/
    condition:
        $serialized
}

Sigma Rule

title: CVE-2026-7635 - PHP Object Injection via User-Agent in coreActivity Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with PHP serialized payloads in User-Agent header targeting WordPress coreActivity plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-login.php'
        cs(User-Agent)|re: 'O:\d+:|a:\d+:|s:\d+:'
    condition: selection
falsepositives:
    - Legitimate use of serialized data in User-Agent (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-7635 - PHP Object Injection via User-Agent in coreActivity"; flow:to_server; http.user_agent; content:"O:"; distance:0; within:10; pcre:"/O:\d+:/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Manually clean the database by removing malicious entries from wp_coreactivity_logmeta:

   DELETE FROM wp_coreactivity_logmeta WHERE meta_value REGEXP '^[Oa]:[0-9]+:';
   

3. Implement a WAF rule to block User-Agent headers containing PHP serialized patterns (e.g., O:\d+:).

Long-term Fix:

• The vendor must release a patched version that:
  • Sanitizes the User-Agent header before storage.
  • Validates that data was serialized by the application before calling maybe_unserialize().
  • Ensures DeviceDetector::setUserAgent() receives a string.

Workarounds:

• Restrict access to the Logs page via IP whitelisting or authentication.
• Monitor for unusual User-Agent headers and block them at the reverse proxy level.

Valters IT
DevSecOps & Cyber Threat Intelligence