CVE Alert: CVE-2026-76834 – b2evolution

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code execution if suitable POP gadget chains exist.

## AI Summary Analysis

**Risk verdict:** Treat as a high-priority internet-facing weakness, but exploitation urgency cannot be confirmed because KEV, SSVC, EPSS and PoC status are not provided.

**Why this matters:** Successful exploitation could give an unauthenticated attacker control over application data and server-side execution, potentially enabling defacement, data theft, malware deployment or service disruption. The impact is greatest where the CMS shares hosting, credentials, databases or network access with other business systems. The absence of reliable exploitation telemetry leaves the likelihood uncertain, not the potential impact.

**Most likely attack path:** An attacker would send a crafted request directly to the exposed plugin-processing endpoint: AV:N, AC:L, PR:N and UI:N indicate no account or victim action is normally required, although AT:P means a suitable runtime condition or gadget chain must be present. Scope is unchanged, so the immediate compromise is expected within the CMS security authority; further movement remains possible through stored secrets, shared hosting or reachable internal services.

**Who is most exposed:** Publicly accessible, legacy CMS installations running on shared PHP hosting or with administrative interfaces and plugin functionality exposed to the internet are most at risk. Unsupported deployments with weak isolation and excessive service-account permissions warrant particular attention.

Review web logs for unusual POSTs to the plugin callback endpoint.

Alert on serialized-object markers, negative integer array keys or anomalous request bodies.

Hunt for unexpected PHP child processes, outbound connections and file changes.

Check CMS, web-server and database logs for activity immediately after suspicious requests.

Mitigation and prioritisation:

Apply the vendor-supported security fix or migrate promptly; do not rely on the incomplete historical correction.

Until remediated, restrict the endpoint at the reverse proxy and block unsolicited internet access where feasible.

Isolate the CMS, rotate exposed secrets and minimise its filesystem and database privileges.

Test the change in staging, then deploy through controlled change management with rollback and post-patch monitoring.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.