Live › vulnerability › CVE-2026-116869
The myPOS Checkout plugin for WordPress and WooCommerce, versions up to 1.4.5, has a PHP Object Injection flaw. A shop manager account can pass crafted serialized data that the plugin unserializes, which can lead to code execution depending on the classes available on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the myPOS Checkout plugin at version 1.4.5 or lower, where users with the shop manager role can reach the plugin's input handling. The sources do not describe the exact entry point, so it is unknown whether anonymous visitors can trigger it. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
1.4.5 or lower.1.4.5 (the sources do not name the exact fixed release).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.