PHP Object Injection Vulnerability in Boost Plugin for WordPress

CVE-2026-7637

What is CVE-2026-7637?

The Boost plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie in versions up to 2.0.3. This vulnerability allows unauthenticated attackers to inject PHP Objects, potentially leading to serious security implications. Notably, the absence of a known PHP Object Injection (POP) chain means that this flaw alone does not pose a direct threat unless combined with other plugins or themes that contain a POP chain. In scenarios where a POP chain is present, attackers could execute critical actions such as deleting files, accessing sensitive information, or executing arbitrary code.

References