CVE-2024-12600: WooCommerce Product Tabs RCE Vulnerability

CVE-2024-12600 Overview

CVE-2024-12600 is a PHP Object Injection vulnerability in the Custom Product Tabs Lite for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.9.0. It stems from unsafe deserialization of untrusted input passed through the frs_woo_product_tabs parameter. Authenticated users with Shop Manager or higher privileges can inject arbitrary PHP objects into the application. The plugin itself contains no known Property-Oriented Programming (POP) chain. However, when a POP chain exists in another installed plugin or theme, attackers can chain the injection to delete arbitrary files, exfiltrate sensitive data, or execute code on the server.

Critical Impact
Shop Manager accounts can trigger PHP Object Injection that, combined with a POP chain from any other installed component, may lead to arbitrary code execution, file deletion, or data disclosure.

Affected Products

Custom Product Tabs Lite for WooCommerce plugin for WordPress — all versions through 1.9.0
WordPress sites running WooCommerce with the affected plugin installed
Sites with additional plugins or themes that expose usable POP gadget chains

Discovery Timeline

2025-01-25 - CVE-2024-12600 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12600

Vulnerability Analysis

The vulnerability is classified as Insecure Deserialization under [CWE-502]. The plugin reads user-controlled data from the frs_woo_product_tabs request parameter and passes it directly to PHP's unserialize() function. Because deserialization instantiates arbitrary objects and triggers magic methods such as __wakeup() and __destruct(), attacker-controlled serialized payloads become executable object graphs. Exploitation requires an authenticated account at the Shop Manager role or higher, which limits the exposed attack surface but does not neutralize the risk. WordPress sites that host multiple plugins commonly contain reusable POP gadgets, so the practical impact frequently extends to remote code execution.

Root Cause

The root cause is the deserialization of untrusted input at the vulnerable code path in woocommerce-custom-product-tabs-lite.php around line 372. The plugin trusts the frs_woo_product_tabs parameter and does not validate, sanitize, or restrict its structure before invoking deserialization. See the WordPress Plugin Source Code for the vulnerable routine.

Attack Vector

An authenticated attacker holding Shop Manager or higher privileges submits a crafted frs_woo_product_tabs value containing a serialized PHP object. When the plugin deserializes the payload, PHP instantiates the specified class and invokes its magic methods. If a compatible POP chain is present in any installed plugin, theme, or core dependency, the object graph reaches sinks that write files, read files, or execute code. The attack traverses the network and requires no user interaction beyond the attacker's own authenticated session.

No public exploit code or verified proof-of-concept is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-12600

Indicators of Compromise

HTTP POST or GET requests containing the frs_woo_product_tabs parameter with values beginning with serialized PHP markers such as O:, a:, or s:.
Unexpected file creation, modification, or deletion in the WordPress webroot following Shop Manager authenticated sessions.
PHP error log entries referencing unserialize(), __wakeup, or __destruct originating from woocommerce-custom-product-tabs-lite.php.
New or modified administrator accounts, scheduled tasks, or wp_options entries created in proximity to plugin activity.

Detection Strategies

Inspect web server access logs for the frs_woo_product_tabs parameter carrying non-standard serialized payloads.
Deploy a web application firewall rule that flags PHP serialization patterns inside WooCommerce product tab requests.
Perform integrity monitoring on wp-content/plugins/ and the WordPress uploads directory to identify unauthorized writes.
Audit Shop Manager and Administrator role assignments to reduce the population of accounts capable of triggering the vulnerability.

Monitoring Recommendations

Forward WordPress access logs, PHP error logs, and WooCommerce audit events to a centralized log platform for correlation.
Alert on any serialized object indicators (O:\d+:", a:\d+:{) appearing in request bodies to /wp-admin/ endpoints.
Monitor outbound network connections from the PHP-FPM worker or webserver process for anomalous destinations indicative of post-exploitation.
Review WooCommerce product edit history for unexpected changes to custom tab data by Shop Manager accounts.

How to Mitigate CVE-2024-12600

Immediate Actions Required

Update the Custom Product Tabs Lite for WooCommerce plugin to the version released in the fix changeset without delay.
Rotate credentials and enforce multi-factor authentication for all Shop Manager and Administrator accounts.
Audit installed plugins and themes to remove abandoned or unnecessary components that could supply POP gadget chains.
Review recent Shop Manager activity for signs of exploitation before applying the patch.

Patch Information

The maintainer addressed the deserialization sink in the plugin repository. Details of the corrected code path are available in the WordPress Plugin Changeset. Site owners should install the fixed release through the WordPress plugin updater or by deploying the patched files directly to wp-content/plugins/woocommerce-custom-product-tabs-lite/.

Workarounds

Deactivate and remove the Custom Product Tabs Lite for WooCommerce plugin until the patched version is applied.
Restrict the Shop Manager role to a minimal set of trusted operators and revoke unused accounts.
Deploy a web application firewall rule that blocks requests carrying serialized PHP objects in the frs_woo_product_tabs parameter.
Disable plugins that expose known POP chains until a full inventory of installed components is validated.

bash

# WP-CLI commands to inventory and update the affected plugin
wp plugin list --name=woocommerce-custom-product-tabs-lite --fields=name,status,version
wp plugin update woocommerce-custom-product-tabs-lite
wp plugin deactivate woocommerce-custom-product-tabs-lite   # if patched version is not yet available