PHP Object Injection Vulnerability in WooCommerce Custom Product Tabs Plugin

CVE-2024-12721

What is CVE-2024-12721?

The Custom Product Tabs For WooCommerce plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to insecure deserialization of the 'wb_custom_tabs' parameter. This flaw exists in all versions up to and including 1.2.4 and impacts authenticated users with Shop Manager-level access and higher. Attackers could exploit this vulnerability to inject a PHP object, potentially leading to unauthorized file deletion, sensitive data exposure, or arbitrary code execution if a suitable PHP Object Pollution (POP) chain exists through other installed plugins or themes.

References