Blesta <= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities
• Software Link:
• Affected Versions:
All versions from 3.0.0 to 5.13.1.
• Vulnerabilities Description:
The vulnerabilities exist because user input passed through the “invoices” POST parameter or the “item-ext-ref” GET parameter when dispatching the Checkout2::validate() or Checkout2::success() method is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by malicious client users to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code (RCE).
Successful exploitation of this issue requires the 2Checkout payment gateway to be installed.
• Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-25614.php
• Solution:
Apply the vendor patch or upgrade to version 5.13.2 or later.
• Disclosure Timeline:
[19/01/2026] – Vendor notified
[22/01/2026] – CVE identifier requested
[28/01/2026] – Version 5.13.2 released
[31/01/2026] – Version 5.13.3 released to address regressions introduced in 5.13.2
[03/02/2026] – CVE identifier assigned
[04/02/2026] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.org) has assigned the name CVE-2026-25614 to these vulnerabilities.
• Credits:
Vulnerabilities discovered by Egidio Romano.