CVE-2024-10828
Published: 13 November 2024
Summary
CVE-2024-10828 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Algolplus Advanced Order Export For Woocommerce. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.5.5. The flaw stems from unsafe deserialization of untrusted input during order export when the "Try to convert serialized values" option is enabled, corresponding to CWE-502. This affects the plugin's core extraction and XML handling components.
Unauthenticated attackers can supply malicious serialized data over the network to inject arbitrary PHP objects. When a suitable POP chain is present, this enables deletion of arbitrary server files, which can be leveraged for remote code execution by targeting files such as wp-config.php. The vulnerability carries a CVSS 3.1 score of 8.1 reflecting high complexity but no required authentication or user interaction.
The current and peak EPSS score stands at 0.3552 with no material upward trajectory after disclosure. Available references include Wordfence threat intelligence and direct links to the plugin's XMLWriter and extractor code but contain no explicit statements on patches or mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33321
Vulnerability details
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is…
more
enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.