Untrusted Input Vulnerability in BuddyPress WooCommerce My Account Integration Could Lead to PHP Object Injection and File Deletion

CVE-2024-2025

Summary

The BuddyPress WooCommerce My Account Integration plugin for WordPress is susceptible to PHP Object Injection due to an issue in the deserialization of untrusted input within the get_simple_request function. This vulnerability affects all versions up to and including 3.4.20. Authenticated attackers with subscriber-level access can exploit this flaw to inject PHP Objects. If a potentially dangerous object manipulation chain exists through another installed plugin or theme, it presents the risk of arbitrary file deletion, sensitive data exposure, or arbitrary code execution, which can severely compromise the security of the affected WordPress site.

References