CVE-2024-12600

Name of the Vulnerable Software and Affected Versions Custom Product Tabs Lite for WooCommerce plugin for WordPress versions prior to 1.9.0

Description The issue is related to PHP Object Injection via deserialization of untrusted input from the frs woo product tabs parameter. This allows authenticated attackers with Shop Manager-level access and above to inject a PHP Object. While no known POP chain is present in the vulnerable software, the presence of one via an additional plugin or theme could enable attackers to delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations For versions prior to 1.9.0, update to version 1.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the frs woo product tabs parameter to minimize the risk of exploitation.