WooCommerce Social Login Plugin Vulnerable to PHP Object Injection

CVE-2024-5871

Summary

The WooCommerce - Social Login plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input from the 'woo_slg_verify' parameter. This vulnerability affects all versions up to and including 2.6.2. Unauthenticated attackers can exploit this flaw to inject PHP objects, posing significant risks if any existing plugins or themes on the target system allow the establishment of a PHP Object Proximity (POP) chain. Such an exploit could enable attackers to delete arbitrary files, access sensitive information, or execute malicious code, highlighting the need for immediate remedial action by users of affected versions.

References