PHP Object Injection Vulnerability in Order Export & Order Import for WooCommerce Plugin by WordPress

CVE-2024-13921

What is CVE-2024-13921?

The Order Export & Order Import for WooCommerce plugin for WordPress is susceptible to PHP Object Injection due to the improper deserialization of untrusted input from the 'form_data' parameter. This vulnerability allows authenticated users with Administrator-level access to inject a PHP Object, posing a risk only when combined with another plugin or theme that contains a PHP Object Pollution (POP) chain. In such cases, the attacker can potentially execute actions such as deleting arbitrary files, accessing sensitive data, or executing malicious code, contingent upon the specifics of the existing POP chain.

References