Cyber Posture

CVE-2024-12627

High

Published: 11 January 2025

Published
11 January 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0081 74.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Security Summary

CVE-2024-12627 is a PHP Object Injection vulnerability (CWE-502) in the Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress, affecting all versions up to and including 1.3.5. The flaw stems from deserialization of untrusted input sourced from post content and passed to the capture_email AJAX action, enabling PHP Object injection.

Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject a PHP Object. No known Property-Oriented Programming (POP) chain exists within the vulnerable plugin itself. However, if a POP chain is available through an additional plugin or theme on the target system, exploitation could lead to arbitrary file deletion, retrieval of sensitive data, or code execution. The CVSS v3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Mitigation is addressed in WordPress plugin trac changeset 3219466, which patches the issue in the plugin's trunk at inc/class-cx-rest.php. Additional details on the vulnerability, including remediation guidance, are available in the Wordfence threat intelligence advisory.

Details

CWE(s)
CWE-502

References