WooCommerce Product Catalog Plugin Vulnerable to PHP Object Injection

CVE-2024-8922

Summary

The WooCommerce Product Enquiry plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to deserialization of untrusted input in the enquiry_detail.php file. This vulnerability impacts all versions up to and including 2.2.33.32. Authenticated attackers with Author-level access or higher can exploit this weakness by injecting a PHP Object. Although no known PHP Object Pollution (POP) chain exists in the vulnerable software, it poses risks if a POP chain is introduced through additional plugins or themes on the target site. Exploitation could enable attackers to delete arbitrary files, retrieve sensitive information, or execute malicious code, thereby compromising the security of WordPress installations.

References