Unauthenticated Attackers Can Inject PHP Objects and Lead to Remote Code Execution via WooCommerce Plugin

CVE-2024-10828

Summary

The Advanced Order Export For WooCommerce plugin for WordPress possesses a PHP Object Injection vulnerability that affects all versions up to 3.5.5. This vulnerability arises from the deserialization of untrusted input during the order export process when the 'Try to convert serialized values' option is enabled. An unauthenticated attacker can exploit this flaw to inject a PHP object. If a potentially harmful PHP object is successfully instantiated, it can create a Precedence of Property (POP) chain, ultimately allowing the attacker to delete arbitrary files on the server. Such actions can lead to severe consequences, including the potential for remote code execution, especially if critical files like wp-config.php are compromised.

References