CVE-2026-76834 is a deserialization of untrusted data vulnerability in b2evolution CMS versions 6.7.8 through 7.2.5. The vulnerability stems from an incomplete fix for CVE-2016-8901, where the function param_check_serialized_array() fails to reject serialized payloads containing negative integer array keys. Attackers can exploit this by sending crafted serialized PHP objects in POST requests to htsrv/call_plugin.php, bypassing validation and reaching the unserialize() function. This results in arbitrary PHP object instantiation with attacker-controlled properties, which may lead to remote code execution if appropriate POP (Property Oriented Programming) gadget chains are available.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary PHP code on the affected system, potentially leading to full system compromise. The vulnerability allows bypassing of input validation and unsafe deserialization, which is a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious POST requests containing serialized data. Avoid exposing the htsrv/call_plugin.php endpoint to untrusted users.