{"id":"CVE-2026-116869","kind":"vulnerability","aliases":["CVE-2026-116869"],"related":[],"title":"myPOS Checkout WordPress plugin: PHP object injection by shop managers","description":"Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.","summary":"The myPOS Checkout plugin for WordPress and WooCommerce, versions up to 1.4.5, has a PHP Object Injection flaw. A shop manager account can pass crafted serialized data that the plugin unserializes, which can lead to code execution depending on the classes available on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mypos","package","php","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.4.5"],"how_to_check":"- Check the installed myPOS Checkout plugin version in the WordPress admin plugins list, or confirm it is `1.4.5` or lower.\n- Confirm whether the plugin is active on the site.","fix":"- myPOS Checkout: a version newer than `1.4.5` (the sources do not name the exact fixed release).","status":"open","published_at":"2026-10-29T16:18:01+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:51+00:00","updated_at":"2026-10-29T16:29:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:29:51Z","model":"claude-haiku-5-5","output":{"fix":"- myPOS Checkout: a version newer than `1.4.5` (the sources do not name the exact fixed release).","reach":"unknown","title":"myPOS Checkout WordPress plugin: PHP object injection by shop managers","impact":"high","summary":"The myPOS Checkout plugin for WordPress and WooCommerce, versions up to 1.4.5, has a PHP Object Injection flaw. A shop manager account can pass crafted serialized data that the plugin unserializes, which can lead to code execution depending on the classes available on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","mypos","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Shop manager gains code execution through unsafe PHP deserialization","analyst_note":"Confirm the fixed plugin version and the vulnerable entry point from the NVD entry or the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-116869.","how_to_check":"- Check the installed myPOS Checkout plugin version in the WordPress admin plugins list, or confirm it is `1.4.5` or lower.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.4.5"],"who_is_affected":"Sites running the myPOS Checkout plugin at version 1.4.5 or lower, where users with the shop manager role can reach the plugin's input handling. The sources do not describe the exact entry point, so it is unknown whether anonymous visitors can trigger it. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4054,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116869':13A,16A '-2026':12A,15A '1.4.5':33B,75C 'account':43B 'avail':63B 'checkout':2A,24B,74C 'class':62B 'code':57B 'craft':46B 'cve':11A,14A 'data':48B 'depend':59B 'execut':58B 'flaw':39B 'inject':7A,38B,71C 'lead':55B 'manag':10A,42B,68C 'mypo':1A,17B,23B,73C 'object':6A,37B,70C 'packag':18B 'pass':45B 'php':5A,19B,36B,69C 'plugin':4A,25B,51B 'serial':47B 'shop':9A,41B,67C 'site':66B 'unseri':52B 'version':30B,76C 'woocommerc':20B,29B 'wordpress':3A,21B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the myPOS Checkout plugin at version 1.4.5 or lower, where users with the shop manager role can reach the plugin's input handling. The sources do not describe the exact entry point, so it is unknown whether anonymous visitors can trigger it. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116869","severity":null,"published_at":"2026-10-29T16:18:01+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}