CVE-2024-11465: Custom Product Tabs WooCommerce RCE Flaw

CVE-2024-11465 Overview

CVE-2024-11465 is a PHP Object Injection vulnerability in the Custom Product Tabs for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.5. The plugin deserializes untrusted input from the yikes_woo_products_tabs post meta parameter without validation. Authenticated attackers holding Shop Manager privileges or higher can inject arbitrary PHP objects into the application. The vulnerability maps to [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Attackers with Shop Manager access can inject PHP objects that, when combined with a Property Oriented Programming (POP) chain from another installed plugin or theme, enable arbitrary file deletion, sensitive data disclosure, or remote code execution.

Affected Products

Yikesinc Custom Product Tabs for WooCommerce plugin for WordPress
All versions up to and including 1.8.5
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2025-01-07 - CVE-2024-11465 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11465

Vulnerability Analysis

The Custom Product Tabs for WooCommerce plugin stores custom tab configuration in WordPress post metadata under the yikes_woo_products_tabs key. When the plugin retrieves this metadata, it passes the stored value to PHP's unserialize() function without validating that the input is trustworthy. Because WordPress post meta can be modified by users with Shop Manager capabilities, an authenticated attacker can inject a crafted serialized payload that instantiates arbitrary PHP objects during deserialization.

By itself, the plugin contains no gadget chain that would translate object instantiation into a concrete impact. However, WordPress environments typically host dozens of additional plugins and themes. If any co-installed component exposes a suitable Property Oriented Programming (POP) chain, the injected object triggers method calls on attacker-controlled data during PHP's object destruction or wakeup lifecycle. This is the standard exploitation pattern for [CWE-502] deserialization flaws in the WordPress ecosystem.

Root Cause

The root cause is the direct use of unserialize() on data that authenticated users can influence. The vulnerable deserialization occurs in multiple locations across the plugin, including class.yikes-woo-generate-html.php, class.yikes-woo-saved-tabs.php, and class.yikes-woo-tabs-display.php. The plugin trusts the integrity of yikes_woo_products_tabs post meta and does not use safer alternatives such as JSON encoding or the allowed_classes parameter introduced in PHP 7.

Attack Vector

Exploitation requires an authenticated session with Shop Manager privileges or higher. The attacker submits a crafted serialized PHP payload through the plugin's product tab management interface, which stores the payload in the yikes_woo_products_tabs post meta field. When the plugin later renders the product tab, PHP deserializes the payload and instantiates the specified class hierarchy. See the Wordfence Vulnerability Report and the WordPress plugin source references for the specific sink locations.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-11465

Indicators of Compromise

Serialized PHP object markers such as O:, a:, or s: written into the yikes_woo_products_tabs post meta field in the wp_postmeta table.
Unexpected file deletions, outbound connections, or PHP errors originating from WordPress product pages after Shop Manager account activity.
Modifications to product tab configuration by user accounts that do not normally manage catalog content.

Detection Strategies

Query the wp_postmeta table for meta_key = 'yikes_woo_products_tabs' and inspect entries for serialized objects containing class names not defined by the plugin.
Review WordPress audit logs for Shop Manager or Administrator accounts editing product tabs at unusual times or in bulk.
Correlate PHP error logs with product page requests to identify failed deserialization attempts, which often precede successful exploitation.

Monitoring Recommendations

Alert on any writes to post meta keyed yikes_woo_products_tabs where the value begins with O: followed by a class name string.
Monitor for new or modified files in the WordPress wp-content directory following product tab edits.
Track privilege changes and new account creation for the Shop Manager and Administrator roles.

How to Mitigate CVE-2024-11465

Immediate Actions Required

Update the Custom Product Tabs for WooCommerce plugin to a version later than 1.8.5 that includes the fix from WordPress Changeset 3271575.
Audit all Shop Manager and Administrator accounts, remove unused accounts, and reset credentials for any that show signs of compromise.
Inspect existing yikes_woo_products_tabs post meta records for serialized payloads that reference unexpected classes and remove them.

Patch Information

The vendor addressed the vulnerability in the changeset published at WordPress Changeset 3271575. Site operators should upgrade to the patched release available through the WordPress plugin repository. Confirm the plugin version in the WordPress admin under Plugins after applying the update.

Workarounds

Deactivate and remove the Custom Product Tabs for WooCommerce plugin until it can be updated to a fixed version.
Restrict the Shop Manager role using a capability manager plugin to prevent modification of custom product tab metadata.
Deploy a web application firewall (WAF) rule that blocks POST bodies containing serialized PHP object markers targeting product tab admin endpoints.

bash

# Example WP-CLI commands to identify and remove suspicious serialized payloads
wp db query "SELECT post_id, LEFT(meta_value, 80) FROM wp_postmeta WHERE meta_key = 'yikes_woo_products_tabs' AND meta_value LIKE 'O:%';"
wp plugin update yikes-inc-easy-custom-woocommerce-product-tabs
wp plugin get yikes-inc-easy-custom-woocommerce-product-tabs --field=version