PHP Object Injection Vulnerability in Compare Products for WooCommerce Plugin

CVE-2024-12313

Summary

The Compare Products for WooCommerce plugin for WordPress is susceptible to PHP Object Injection due to unsafe deserialization of untrusted input from the 'woo_compare_list' cookie across all versions up to and including 3.2.1. This vulnerability enables unauthenticated attackers to inject arbitrary PHP objects. While the vulnerable software lacks a known Point of Possibility (POP) chain, the risk escalates if additional plugins or themes are installed on the target system, potentially allowing attackers to execute arbitrary code, delete files, or access sensitive data.

References