Skip to content
Sign in
6.5 Medium

CVE-2026-1235 The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow…

Description

The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Affected products and versions

Product Affected versions Fixed in
WP eCommerce 3.15 earliest → 3.15.1 No fix stated

Other CVEs of WP eCommerce

The 2 CVEs of WP eCommerce →
CVE-2026-1128 The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could… 4.3 Medium
Track this CVE