PHP Object Injection Vulnerability in Tabs for WooCommerce by WordPress

CVE-2024-13831

Summary

The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection due to improper deserialization of untrusted input in the 'product_has_custom_tabs' function. This vulnerability affects all versions up to and including 1.0.0 and can be exploited by authenticated attackers with Shop Manager-level access or higher. While there is no known PHP Object Pollution (POP) chain in the vulnerable software itself, the presence of additional plugins or themes that introduce a POP chain could potentially amplify the risk. This may allow attackers to execute arbitrary code, delete files, or retrieve sensitive data, depending on the specific POP chain utilized.

References