{"id":"CVE-2024-12313","aliases":["EUVD-2024-50764","GHSA-p3wm-hf9c-vv27"],"status":"published","title":"Compare Products for WooCommerce \u003c= 3.2.1 - Unauthenticated PHP Object Injection","description":"The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00814,"percentile":0.57518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2025-01-07T04:22:01Z","modified":"2026-06-17T06:59:28Z","products":[{"vendor":"a3rev","product":"compare products for woocommerce"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638e8e67-38b3-4fc4-bd77-8f268030a93a?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L219"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L237"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L256"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L275"},{"url":"https://plugins.trac.wordpress.org/changeset/3215166/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12313"},{"url":"https://plugins.trac.wordpress.org/changeset/3215166"},{"url":"https://github.com/advisories/GHSA-p3wm-hf9c-vv27"}],"sources":{"cve":[{"id":"CVE-2024-12313","title":"Compare Products for WooCommerce \u003c= 3.2.1 - Unauthenticated PHP Object Injection","description":"The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","status":"published","published":"2025-01-07T04:22:01.1Z","modified":"2026-04-08T16:57:22.77Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-50764","description":"The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","status":"published","published":"2025-01-07T04:22:01Z","modified":"2026-04-08T16:57:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:56.140077Z"}],"ghsa":[{"id":"GHSA-p3wm-hf9c-vv27","title":"The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection...","description":"The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","status":"published","published":"2025-01-07T06:32:15Z","modified":"2026-04-08T18:33:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:07:15.710349Z"}],"nvd":[{"id":"CVE-2024-12313","description":"The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","status":"published","published":"2025-01-07T05:15:17.853Z","modified":"2026-06-17T06:59:28.96Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:10:41.838321Z"}]}}