EIP-2026-114139

This exploit demonstrates a PHP object injection vulnerability in the WordPress plugin Ultimate Product Catalog (versions <= 4.2.24). The vulnerability arises from insecure deserialization of the 'upcp_cart_products' cookie in the 'UPCP_Add_To_Cart' function, allowing an unauthenticated attacker to inject malicious serialized objects.