CVE-2026-57677

The Novalnet Payment Gateway for WooCommerce plugin version 12.10.3 and earlier is vulnerable to unauthenticated PHP Object Injection. An attacker can remotely send a crafted request, leading to arbitrary PHP code execution on the server.

The risk includes full server compromise, customer data theft, and modification of store content. The attack does not require authentication, making it easier to exploit.

Immediately update the Novalnet Payment Gateway for WooCommerce plugin to version 12.10.4 or later. If an update is not possible, temporarily disable the plugin.