CVE-2026-84099

wpStoreCart 5 (IDB Ecommerce) WordPress plugin through 5.0.7 is vulnerable to unauthenticated PHP object injection via the bundled wpsc-membership-pro add-on, specifically its paypal.php file. The endpoint fails to restrict the permitted classes during deserialization of user-supplied input, allo...