CVE-2026-93624

Executive Summary

CVE-2026-93624 is a PHP Object Injection vulnerability (CWE-502) in the Music Player for WooCommerce WordPress plugin, affecting all versions up to and including 1.9.1. The flaw requires an attacker to hold at least a shop manager role (high privileges), which restricts the attack surface to authenticated users with elevated store-level access. Successful exploitation enables full object injection, leading to potential remote code execution, sensitive data disclosure, and complete site compromise, as reflected in the CVSS score of 7.2 (High).

Technical Analysis

The vulnerability class is PHP Object Injection, formally CWE-502: Deserialization of Untrusted Data. In PHP applications, this class of flaw arises when user-controlled input is passed to the unserialize() language construct (or an equivalent unserialization sink) without adequate validation of the object graph. When attacker-supplied serialized data contains a reference to a class defined within the application or a bundled dependency, PHP instantiates that class and reconstructs its properties. If any such class implements a magic method (such as __wakeup(), __destruct(), __toString(), or __call()), the attacker can steer execution into those methods with fully controlled property values, forming what is commonly termed a "POP chain" (Property-Oriented Programming).

The NVD description states that this is a "Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions." This establishes two key facts: (1) the vulnerable code path is reachable by a user holding the WooCommerce "shop manager" role, and (2) the plugin's input handling permits untrusted serialized data to reach an unserialization sink. Shop manager is a non-administrative but privileged role in WooCommerce that grants control over products, orders, and certain store settings; it is a common delegation role in larger e-commerce operations. No further code-level details — such as the specific endpoint, parameter name, function name, or the exact unserialize sink — are provided in the NVD description. Any such specifics are therefore not asserted here.

Because the CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, the vulnerability is network-reachable (AV:N), requires no special conditions beyond the privileges (AC:L), demands high privileges (PR:H), needs no user interaction (UI:N), and yields high confidentiality, integrity, and availability impact within the same security scope (S:U). This profile is consistent with an authenticated attacker who can already manage plugin-related data and can leverage object injection to escalate beyond the shop manager role or to achieve code execution. Note that the plugin itself is not identified with a vendor in the supplied data; the product branding "Music Player for WooCommerce" is used as the vendor designation for metadata purposes only.

Exploitation Scenarios

No public proof-of-concept is available, and no exploit code or Nuclei template has been published. The attack chain below is inferred strictly from the vulnerability class (PHP Object Injection) and the role constraint stated in the NVD description; implementation-specific details are intentionally omitted because they are not present in the source data.

1. Reconnaissance and target identification. An attacker identifies a WordPress site running the Music Player for WooCommerce plugin at version 1.9.1 or earlier. Detection is trivial via publicly served plugin assets (for example, files under the wp-content/plugins/music-player-for-woocommerce path) or via vulnerability scanners. The attacker must also either possess valid shop manager credentials or have obtained them through phishing, credential stuffing, or prior compromise.

2. Triggering the flaw. Once authenticated as a shop manager, the attacker locates the plugin input path that accepts serialized data. Because shop managers can manage store content and plugin-specific settings, the attacker submits a crafted serialized PHP object to that sink. The vulnerability class dictates that the plugin fails to reject or sanitize the supplied object structure before deserialization occurs.

3. Payload and execution method. The attacker crafts a serialized payload referencing a class present in the plugin or its loaded dependencies whose magic methods perform a useful action when the object is reconstructed — for example, writing a file, invoking a callable, or manipulating an internal property that later flows into a dangerous sink. The precise class names and gadget chain are not disclosed in the available data; at the vulnerability-class level, the objective is to convert controlled object properties into a side effect such as arbitrary file write or code execution.

4. Post-exploitation impact. Successful object injection commonly yields remote code execution in the web server context, allowing the attacker to install persistent backdoors, exfiltrate customer and order data (high confidentiality impact), alter store content and pricing (high integrity impact), and disrupt availability. Given the high privileges required, the attacker may also pivot from shop manager to full site administrator.

Impact Assessment

The CVSS base score is 7.2 (High). Subscores: Confidentiality High, Integrity High, Availability High, all within an unchanged scope. The attack requires high privileges (shop manager), which limits the pool of viable attackers to insiders, compromised accounts, or attackers who have already achieved store-level access. However, the consequences of success are severe: a WooCommerce store is a high-value target holding customer PII, payment-adjacent data, and business-critical order flows. Blast radius includes the host WordPress installation and any co-hosted sites on the same infrastructure. Because the plugin is unpatched, every installation at version <= 1.9.1 is exposed until the vendor releases a fix or the plugin is removed. EPSS has not yet scored this CVE, and it is not listed in CISA KEV; there is no evidence of in-the-wild exploitation at this time.

Detection Guidance

Sigma Rule

title: Music Player for WooCommerce PHP Object Injection Attempt
id: 8f3c1a92-5b7e-4d21-9c6a-2f0e7b4d1a55
status: experimental
description: Detects serialized PHP object payloads (O:\d+:" pattern) submitted to WordPress requests associated with the Music Player for WooCommerce plugin, indicating attempted PHP Object Injection (CVE-2026-93624).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93624
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'music-player-for-woocommerce'
      - 'mpfw'
  selection_payload:
    cs-uri-query|contains: 'O:'
    cs-uri-query|re: 'O:\d+:"[A-Za-z_\\]+":\d+:\{'
  condition: selection_uri and selection_payload
falsepositives:
  - Legitimate serialized data in benign plugin requests (rare in query strings)
level: high

YARA Rule

rule CVE_2026_93624_PHP_Object_Injection
{
    meta:
        description = "Detects serialized PHP object payloads targeting Music Player for WooCommerce (CVE-2026-93624)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93624"
        date = "2026-01-01"
        severity = "high"

    strings:
        $php_obj = /O:[0-9]{1,4}:"[A-Za-z_\\][A-Za-z0-9_\\]{0,128}":[0-9]{1,4}:\{/
        $magic_wakeup = "__wakeup"
        $magic_destruct = "__destruct"
        $plugin_ref = "music-player-for-woocommerce"

    condition:
        $php_obj and (any of ($magic_*)) and $plugin_ref
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93624 Music Player for WooCommerce PHP Object Injection Attempt"; flow:established,to_server; http.uri; content:"music-player-for-woocommerce"; http.uri; content:"O:"; pcre:"/O:\d+:\"[A-Za-z_\\\\]+\":\d+:\{/U"; classtype:web-application-attack; reference:cve,2026-93624; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93624; sid:202693624; rev:1;)

Elastic Detection

sequence by host.name, user.name with maxspan=30s
  [ network where event.action == "network_request"
      and url.path contains "music-player-for-woocommerce" ]
  [ network where event.action == "network_request"
      and url.query : regex~ /O:\d+:"[A-Za-z_\\]+":\d+:\{/ ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri, cs_uri_stem . "?" . cs_uri_query)
| where match(uri, "(?i)music-player-for-woocommerce")
| where match(uri, "O:\\d+:\"[A-Za-z_\\\\]+\":\\d+:\\{")
| table _time, src_ip, method, uri, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,appsec,woocommerce,">
  <rule id="2026936" level="12">
    <if_sid>31100</if_sid>
    <url>music-player-for-woocommerce</url>
    <regex>O:\d+:"[A-Za-z_\\]+":\d+:\{</regex>
    <description>CVE-2026-93624: PHP Object Injection attempt against Music Player for WooCommerce</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or patch reference is available from any tracked source for CVE-2026-93624 as of this writing.

1. Immediate mitigations. Restrict and audit the WooCommerce shop manager role — remove it from any account that does not strictly require it, and enforce strong authentication (MFA) on all privileged accounts, since exploitation requires high privileges. If the plugin is not business-critical, deactivate and uninstall Music Player for WooCommerce until a fix is released. Deploy WAF rules or the Suricata/Sigma detections above to block serialized PHP object payloads (O:\d+:"...":\d+:\{) in requests touching plugin paths. Monitor web logs for serialized object patterns in query strings or POST bodies.

2. Patch/upgrade steps. No patch currently exists. Monitor the plugin's distribution channel and the NVD entry for CVE-2026-93624 for an updated version beyond 1.9.1. Once a patched release is published, upgrade immediately and verify the installed version. Until then, treat all sites running <= 1.9.1 as vulnerable.

3. Long-term hardening. Enforce least privilege across all WordPress roles and avoid granting shop manager broadly. Apply the WordPress principle of disabling file editing and restricting plugin installation to administrators. Enable comprehensive logging (web server, PHP, and WordPress audit logs) and forward to a SIEM. Conduct periodic plugin inventory reviews and remove unused plugins to reduce attack surface. Establish a patch-management SLA that tracks plugin CVEs, given the low patch confidence for this issue.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93624
• CWE-502: Deserialization of Untrusted Data — https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• OWASP: PHP Object Injection — https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
• CISA KEV Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-93624 at the time of writing.