CVE-2024-2025
First published: Sat Mar 23 2024(Updated: )
The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Buddypress WooCommerce My Account Integration | <=3.4.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2025?
CVE-2024-2025 has been classified as a high-severity vulnerability due to its potential for PHP Object Injection.
How do I fix CVE-2024-2025?
To fix CVE-2024-2025, update the BuddyPress WooCommerce My Account Integration plugin to version 3.4.21 or later.
What is affected by CVE-2024-2025?
CVE-2024-2025 affects all versions of the BuddyPress WooCommerce My Account Integration plugin up to and including version 3.4.20.
What is the impact of CVE-2024-2025?
The impact of CVE-2024-2025 allows authenticated users to exploit PHP Object Injection, which can lead to serious security breaches.
How does CVE-2024-2025 occur?
CVE-2024-2025 occurs due to deserialization of untrusted input within the get_simple_request function of the affected plugin.
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/buddypress
- canonical/buddypress woocommerce my account integration