Unauthenticated Insecure Deserialization in b2evolution CMS

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901, leaving the application susceptible to insecure deserialization attacks. The vulnerability resides in the param_check_serialized_array() function, which fails to correctly reject serialized PHP payloads containing negative integer array keys. An unauthenticated attacker can exploit this flaw by sending a crafted, malicious serialized PHP object via a POST request to the htsrv/call_plugin.php endpoint.

If the application reaches the unserialize() function with this crafted payload, it results in the instantiation of arbitrary PHP objects. If a suitable Property-Oriented Programming (POP) gadget chain is present within the application environment or associated plugins, the attacker can leverage this instantiation to achieve remote code execution. This vulnerability represents a significant security risk for organizations running affected versions of b2evolution, as it allows for unauthorized interaction with the application backend without prior authentication.

Impact

Successful exploitation of CVE-2026-76834 allows unauthenticated attackers to instantiate arbitrary PHP objects, which can lead to remote code execution when combined with appropriate gadget chains. This may result in full system compromise, data exfiltration, or unauthorized modification of the content management system. The vulnerability affects all users of b2evolution CMS versions 6.7.8 through 7.2.5.

Recommendation

• Upgrade b2evolution CMS to a version beyond 7.2.5 that resolves the incomplete validation logic for CVE-2026-76834.
• Implement web application firewall (WAF) rules to inspect POST requests directed at /htsrv/call_plugin.php for serialized PHP objects (strings starting with 'a:' or 'O:') that contain negative integer array keys.
• Audit existing plugins for the presence of dangerous magic methods (e.g., __destruct, __wakeup) that could serve as POP gadgets for insecure deserialization.