PHP Object Injection Vulnerability in Order Export & Order Import for WooCommerce Plugin by WordPress

CVE-2024-13921

What is CVE-2024-13921?

The Order Export & Order Import for WooCommerce plugin for WordPress is susceptible to PHP Object Injection due to the improper deserialization of untrusted input from the 'form_data' parameter. This vulnerability allows authenticated users with Administrator-level access to inject a PHP Object, posing a risk only when combined with another plugin or theme that contains a PHP Object Pollution (POP) chain. In such cases, the attacker can potentially execute actions such as deleting arbitrary files, accessing sensitive data, or executing malicious code, contingent upon the specifics of the existing POP chain.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References