WordPress · Compare Products For Woocommerce · CVE-2024-12313
**Name of the Vulnerable Software and Affected Versions**
Compare Products for WooCommerce plugin for WordPress versions up to, and including, 3.2.1
**Description**
The issue concerns a PHP Object Injection vulnerability in the Compare Products for WooCommerce plugin for WordPress. This vulnerability occurs through the deserialization of untrusted input from the `woo compare list` cookie, allowing unauthenticated attackers to inject a PHP object. No known POP chain is present in the vulnerable software. However, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
**Recommendations**
For versions up to, and including, 3.2.1, update to a version higher than 3.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the `woo compare list` cookie to minimize the risk of exploitation. Additionally, review installed plugins and themes for potential POP chains that could exacerbate the vulnerability.