Description
Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Novalnet | Novalnet Payment Gateway for WooCommerce | ≤ 12.10.3 | — |
Critical · 9.8
CVE-2026-57677
EUVD-2026-41287GHSA-w8wf-v3vp-wj3x
WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability
Published Jul 2, 2026 · Updated Jul 2, 2026 · Assigned by Patchstack