CVE-2026-7637: WordPress Boost Plugin PHP Object Injection via Cookie (CVSS 9.8)

Executive Summary

A critical PHP Object Injection vulnerability (CVE-2026-7637) has been discovered in the Boost plugin for WordPress, affecting all versions up to and including 2.0.3. The vulnerability carries a CVSS score of 9.8.

The flaw arises from the deserialization of untrusted input contained in the STYXKEY-BOOST_USER_LOCATION cookie, allowing unauthenticated attackers to inject arbitrary PHP objects into the application. While no known POP (Property-Oriented Programming) chain exists within the plugin itself, the presence of a PHP Object Injection point is a critical primitive — any installed plugin or theme that provides a usable POP chain could escalate this to Remote Code Execution, file deletion, data exfiltration, or full site compromise.

WordPress site operators running the Boost plugin version 2.0.3 or earlier should update immediately.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The Boost plugin reads and deserializes the value of the STYXKEY-BOOST_USER_LOCATION HTTP cookie using PHP's unserialize() function without first validating or sanitizing the input.

PHP's unserialize() is inherently dangerous when applied to attacker-controlled data because:

1. Deserialization instantiates PHP objects from serialized strings
2. During instantiation, PHP's magic methods (__wakeup, __destruct, __toString, etc.) execute automatically
3. A "POP chain" — a sequence of gadgets using installed classes — can chain these magic method calls into arbitrary code execution

Attack Mechanism

Attack flow:
1. Attacker crafts a malicious PHP serialized string targeting installed gadget classes
2. Attacker sets the STYXKEY-BOOST_USER_LOCATION cookie to the malicious payload
3. WordPress processes the page request; Boost plugin reads the cookie value
4. Plugin calls unserialize() on the attacker-controlled cookie data
5. PHP instantiates attacker's object, triggering __wakeup or __destruct methods
6. If a POP chain is present in co-installed plugins/themes, this leads to:
   - Remote Code Execution
   - Arbitrary file read/write/delete operations
   - SQL injection via object manipulation
   - Server-Side Request Forgery (SSRF)

POP Chain Risk in WordPress Environments

WordPress sites typically run with dozens of plugins and themes — each adding PHP classes to the runtime. Many popular plugins (WooCommerce, Yoast SEO, various page builders) have historically contained POP chain gadgets.

Even without a known POP chain in Boost itself, the vulnerability is rated 9.8 because:

• The attack surface is any WordPress site running Boost alongside other plugins
• POP chains are routinely discovered and published for the WordPress ecosystem
• An attacker can fingerprint installed plugins and select an appropriate chain

Impact Assessment

Immediate Remediation

Step 1: Update the Boost Plugin

# Via WP-CLI
wp plugin update boost
 
# Verify the installed version
wp plugin get boost --field=version
# Confirm output is greater than 2.0.3

Or update through WordPress Admin > Plugins > Installed Plugins > Boost > Update Now.

Step 2: If Immediate Update Is Not Possible — Disable the Plugin

# Via WP-CLI
wp plugin deactivate boost
 
# Verify deactivation
wp plugin list --status=inactive | grep boost

Step 3: Block Malicious Cookie Payloads at the WAF

Deploy a Web Application Firewall rule to block serialized PHP objects in the cookie header:

# Nginx: block serialized PHP objects in the Boost cookie
if ($http_cookie ~* "STYXKEY-BOOST_USER_LOCATION.*O:[0-9]+:") {
    return 403;
}

# Apache: ModSecurity rule (place in modsecurity.conf)
SecRule REQUEST_COOKIES:STYXKEY-BOOST_USER_LOCATION "@rx O:[0-9]+:" \
    "id:1000001,phase:1,deny,status:403,msg:'PHP Object Injection attempt'"

Step 4: Audit for Compromise

# Check for recently created PHP files in wp-content (potential webshells)
find /var/www/html/wp-content/ -name "*.php" \
  -newer /var/www/html/wp-includes/version.php \
  -not -path "*/cache/*" -type f
 
# Check access logs for suspicious Boost cookie payloads
grep "STYXKEY-BOOST_USER_LOCATION" /var/log/nginx/access.log | \
  grep -E "O:[0-9]+:" | tail -50
 
# Look for unauthorized administrator accounts
wp user list --role=administrator --fields=user_login,user_email,user_registered

Detection Indicators

Post-Remediation Checklist

1. Update Boost plugin beyond version 2.0.3
2. Deactivate the plugin immediately if update cannot be applied
3. Scan wp-content directory for unauthorized PHP files or modifications
4. Review web server access logs for exploitation attempts
5. Audit all administrator accounts and remove any unauthorized entries
6. Reset WordPress secret keys and salts
7. Deploy a WAF rule blocking serialized PHP objects in the Boost cookie header
8. Review all co-installed plugins for known POP chain gadgets
9. Enable file integrity monitoring on the WordPress installation

References

• NVD — CVE-2026-7637
• OWASP — PHP Object Injection
• CWE-502 — Deserialization of Untrusted Data