Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-10828 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Algolplus Advanced Order Export For Woocommerce. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 27% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.5.5. The flaw stems from unsafe deserialization of untrusted input during order export when the "Try to convert serialized values" option is enabled, corresponding to CWE-502. This affects the plugin's core extraction and XML handling components.
Unauthenticated attackers can supply malicious serialized data over the network to inject arbitrary PHP objects. When a suitable POP chain is present, this enables deletion of arbitrary server files, which can be leveraged for remote code execution by targeting files such as wp-config.php. The vulnerability carries a CVSS 3.1 score of 8.1 reflecting high complexity but no required authentication or user interaction.
The current and peak EPSS score stands at 0.3552 with no material upward trajectory after disclosure. Available references include Wordfence threat intelligence and direct links to the plugin's XMLWriter and extractor code but contain no explicit statements on patches or mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33321
Vulnerability Data
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is…
more
enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can uncover deserialization flaws before deployment.
Input validation directly stops deserialization of untrusted data by ensuring inputs are valid before processing.
Engineering principles such as safe deserialization and input sanitization structurally prevent the weakness from being introduced.
Integrity verification tools can detect malformed or tampered serialized data after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.