PT-2024-16575 · WordPress · Advanced Order Export For Woocommerce
Craig Smith
+1
·
Published
2024-11-12
·
Updated
2024-11-19
·
CVE-2024-10828
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Advanced Order Export For WooCommerce plugin for WordPress versions up to, and including, 3.5.5
Description
The issue concerns PHP Object Injection via deserialization of untrusted input during Order export when the
Try to convert serialized values option is enabled. This allows unauthenticated attackers to inject a PHP Object. The presence of a POP chain enables attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files like wp-config.php are deleted.Recommendations
For versions up to, and including, 3.5.5, update to the latest version to protect your site.
As a temporary workaround, consider disabling the
Try to convert serialized values option until a patch is available.
Restrict access to sensitive files on the server to minimize the risk of exploitation.Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Advanced Order Export For Woocommerce