PHP Object Injection Vulnerability in Tabs for WooCommerce by WordPress

CVE-2024-13831

What is CVE-2024-13831?

The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection due to improper deserialization of untrusted input in the 'product_has_custom_tabs' function. This vulnerability affects all versions up to and including 1.0.0 and can be exploited by authenticated attackers with Shop Manager-level access or higher. While there is no known PHP Object Pollution (POP) chain in the vulnerable software itself, the presence of additional plugins or themes that introduce a POP chain could potentially amplify the risk. This may allow attackers to execute arbitrary code, delete files, or retrieve sensitive data, depending on the specific POP chain utilized.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References