CVE-2024-12627
Published: 11 January 2025
Description
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Security Summary
CVE-2024-12627 is a PHP Object Injection vulnerability (CWE-502) in the Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress, affecting all versions up to and including 1.3.5. The flaw stems from deserialization of untrusted input sourced from post content and passed to the capture_email AJAX action, enabling PHP Object injection.
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject a PHP Object. No known Property-Oriented Programming (POP) chain exists within the vulnerable plugin itself. However, if a POP chain is available through an additional plugin or theme on the target system, exploitation could lead to arbitrary file deletion, retrieval of sensitive data, or code execution. The CVSS v3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Mitigation is addressed in WordPress plugin trac changeset 3219466, which patches the issue in the plugin's trunk at inc/class-cx-rest.php. Additional details on the vulnerability, including remediation guidance, are available in the Wordfence threat intelligence advisory.
Details
- CWE(s)