PHP Object Injection Vulnerability in Custom Product Tabs for WooCommerce Plugin by YIKES, Inc.

CVE-2024-11465

Summary

The Custom Product Tabs for WooCommerce plugin for WordPress is susceptible to a PHP Object Injection vulnerability through the deserialization of untrusted input found in the 'yikes_woo_products_tabs' post meta parameter. This could allow authenticated attackers with Shop Manager-level access or higher to inject malicious PHP Objects. No existing Property-Oriented Programming (POP) chain is identified within the vulnerable plugin; however, if a POP chain is facilitated by other plugins or themes on the target site, the attacker may gain the ability to delete arbitrary files, access sensitive information, or execute unauthorized code.

References