CVE-2024-12313: Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection
The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12313?
CVE-2024-12313 is classified as a high severity vulnerability due to the potential for PHP Object Injection leading to unauthorized code execution.
How do I fix CVE-2024-12313?
To fix CVE-2024-12313, update the Compare Products for WooCommerce plugin to the latest version beyond 3.2.1.
Who is affected by CVE-2024-12313?
All users of the Compare Products for WooCommerce plugin for WordPress running version 3.2.1 or earlier are affected by CVE-2024-12313.
What type of vulnerability is CVE-2024-12313?
CVE-2024-12313 is a PHP Object Injection vulnerability that arises from the deserialization of untrusted input from a cookie.
Can CVE-2024-12313 be exploited by unauthenticated attackers?
Yes, CVE-2024-12313 can be exploited by unauthenticated attackers, making it particularly dangerous.