PT-2025-1909 · WordPress · Custom Product Tabs For Woocommerce

Francesco Carlucci · Published 2025-01-25 · Updated 2025-01-25 · CVE-2024-12600

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Custom Product Tabs Lite for WooCommerce plugin for WordPress versions prior to 1.9.0

Description The issue is related to PHP Object Injection via deserialization of untrusted input from the frs woo product tabs parameter. This allows authenticated attackers with Shop Manager-level access and above to inject a PHP Object. While no known POP chain is present in the vulnerable software, the presence of one via an additional plugin or theme could enable attackers to delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations For versions prior to 1.9.0, update to version 1.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the frs woo product tabs parameter to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-12600

Affected Products

Custom Product Tabs For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12600 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/33c16b47-3202-4f26-bf45-98172b8cac45?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3226839 · Note
• https://twitter.com/CVEnew/status/1883044720466604478 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-custom-product-tabs-lite/trunk/woocommerce-custom-product-tabs-lite.php#L372 · Note
• https://twitter.com/VulmonFeeds/status/1883055605742531043 · Twitter Post