CVE-2024-12627
Published: 11 January 2025
Summary
CVE-2024-12627 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-12627 is a PHP Object Injection vulnerability (CWE-502) in the Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress, affecting all versions up to and including 1.3.5. The flaw stems from deserialization of untrusted input sourced from post content and passed to the capture_email AJAX action, enabling PHP Object injection.
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject a PHP Object. No known Property-Oriented Programming (POP) chain exists within the vulnerable plugin itself. However, if a POP chain is available through an additional plugin or theme on the target system, exploitation could lead to arbitrary file deletion, retrieval of sensitive data, or code execution. The CVSS v3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Mitigation is addressed in WordPress plugin trac changeset 3219466, which patches the issue in the plugin's trunk at inc/class-cx-rest.php. Additional details on the vulnerability, including remediation guidance, are available in the Wordfence threat intelligence advisory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51007
Vulnerability details
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content…
more
passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection in public-facing WordPress plugin enables exploitation of the application for code execution or data impact when a POP chain is present.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the PHP Object Injection by identifying, reporting, and patching the deserialization flaw in the Coupon X plugin as addressed in trac changeset 3219466.
Requires validation of untrusted post content input before deserialization in the capture_email AJAX action to block malicious PHP Object injection.
Prohibits or approves user-installed WordPress plugins like Coupon X to prevent deployment of vulnerable third-party software prone to deserialization flaws.