CVE-2024-12313
Published: 07 January 2025
Summary
CVE-2024-12313 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Deeper analysis
The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions through 3.2.1. The flaw stems from unsafe deserialization of untrusted data supplied via the woo_compare_list cookie, as implemented in the plugin's class-wc-compare-functions.php file. This condition is tracked as CWE-502 and carries a CVSS 3.1 score of 8.1.
Unauthenticated attackers can supply a crafted cookie to inject arbitrary PHP objects. Although the plugin itself contains no usable POP chain, the presence of an additional vulnerable plugin or theme on the same WordPress installation could allow the injected object to delete arbitrary files, disclose sensitive data, or achieve remote code execution.
The referenced WordPress plugin repository entries document the vulnerable code paths and a subsequent changeset (3215166) that addresses the issue, indicating that updating to a patched release of the plugin is the intended remediation. The associated EPSS score has remained flat at 0.0698 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50764
Vulnerability details
The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject…
more
a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection in public-facing WordPress plugin enables remote unauthenticated exploitation for arbitrary code execution, file deletion, or data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Patching the vulnerable Compare Products for WooCommerce plugin beyond version 3.2.1 directly remediates the unsafe deserialization of the 'woo_compare_list' cookie.
Validating untrusted inputs from the 'woo_compare_list' cookie before deserialization prevents injection of malicious PHP objects.
Restricting and monitoring user-installed plugins like Compare Products for WooCommerce prevents deployment of components with deserialization vulnerabilities.