CVE-2026-57677: WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, letting the attacker craft a malicious object that triggers unintended code execution. This vulnerability in the Novalnet Payment Gateway for WooCommerce plugin (versions up to and including 12.10.3) is reachable over the network with no authentication required. Successful exploitation gives an attacker full read, write, and availability impact on the affected application, which can include remote code execution, data theft, or complete service disruption. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet without any prior foothold on the host.

• AuthenticationNot required

  No account or session credential of any kind is needed; the attack can be launched by a completely anonymous HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; exploitation is entirely server-side.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites stand in the way of a successful attack.

Blast Radius

• A successful attacker can read any data the web application process can access, including stored payment configuration, WooCommerce order records, and customer personally identifiable information.
• The attacker can write or modify application files and database rows, which covers planting backdoors, altering order states, or overwriting plugin code.
• Depending on the PHP gadget chains present in the WordPress environment, the attacker can achieve arbitrary remote code execution on the underlying server.
• The attacker can crash or degrade the affected service by corrupting application state or consuming server resources, causing a denial of service for legitimate shoppers.