PHP Object Injection Vulnerability in Coupon X Plugin for WordPress

CVE-2024-12627

Summary

The Coupon X plugin for WordPress is susceptible to PHP Object Injection due to unsafe deserialization of untrusted input from post content transmitted to the capture_email AJAX action. This weakness can be exploited by authenticated attackers with Contributor-level access and higher. Although no direct POP chain is present in the plugin code itself, if an additional plugin or theme is installed that provides such a chain, attackers could potentially delete files, gain sensitive information, or execute arbitrary code on the vulnerable site.

References