CVE-2026-94568

HighCVSS 7.2

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The Pay with Vipps for WooCommerce plugin (up to version 6.2.0) contains a deserialization of untrusted data vulnerability allowing Object Injection. An attacker can supply malicious data that is deserialized by the application.

Risk Assessment

This may lead to remote code execution, authentication bypass, or other severe impacts depending on available gadgets. In a WordPress context, it could result in full site compromise.

Recommendation

Update the Pay with Vipps for WooCommerce plugin to a version newer than 6.2.0. Until then, consider disabling the plugin if it is not critical for the store.

Other vulnerabilities in Pay with Vipps for WooCommerce

CVE-2026-97259Medium
Authorization bypass through user-controlled key vulnerability in Pay with Vipps for WooCommerce allows exploiting incorrectly configured access control security levels. Affects versions from n/a through 6.2.4.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS