CVE-2024-12627: Coupon X WordPress Plugin RCE Vulnerability

CVE-2024-12627 Overview

CVE-2024-12627 affects the Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress. All versions up to and including 1.3.5 deserialize untrusted input from post content passed to the capture_email AJAX action. Authenticated attackers with Contributor-level access or higher can inject a PHP Object [CWE-502]. The vulnerable software contains no known Property Oriented Programming (POP) chain. When a POP chain exists in another installed plugin or theme, exploitation can enable arbitrary file deletion, sensitive data retrieval, or code execution.

Critical Impact
Authenticated contributors can trigger PHP Object Injection through the capture_email AJAX handler, potentially escalating to remote code execution when a POP chain is available in the WordPress environment.

Affected Products

Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress
All versions up to and including 1.3.5
WordPress sites where the plugin is installed alongside other plugins or themes that expose a usable POP chain

Discovery Timeline

2025-01-11 - CVE-2024-12627 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12627

Vulnerability Analysis

The plugin exposes an AJAX action named capture_email that accepts post content from authenticated users. This handler passes untrusted input into a PHP deserialization routine without validation or type restrictions. Any authenticated user with Contributor privileges or above can craft a serialized PHP object and submit it through this action. The plugin then instantiates the attacker-controlled object during unserialization.

Because the vulnerable plugin itself does not ship a POP chain, direct code execution requires a suitable gadget elsewhere on the site. WordPress environments commonly host dozens of plugins and themes, and any one of them can introduce classes with magic methods such as __destruct or __wakeup that become gadgets. The composite attack surface makes this class of flaw broadly exploitable in production.

Root Cause

The root cause is insecure deserialization of user-controlled input [CWE-502]. The capture_email handler in class-cx-rest.php invokes PHP's unserialize() function on data supplied through the AJAX request without validating structure, source, or allowed classes. PHP's native deserialization automatically triggers magic methods on reconstructed objects, providing a path from serialized input to method execution.

Attack Vector

Exploitation requires an authenticated account at Contributor level or higher. The attacker submits an HTTP POST request to the WordPress AJAX endpoint invoking the capture_email action with a crafted serialized payload embedded in the post content field. The server unserializes the payload, instantiating attacker-defined objects. If a POP chain is present through another plugin or theme, the magic methods on those objects execute filesystem operations, database reads, or arbitrary PHP code. Refer to the WordPress Plugin Change Log and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2024-12627

Indicators of Compromise

POST requests to admin-ajax.php with the action=capture_email parameter containing serialized PHP data (strings beginning with O:, a:, or s:)
Unexpected file deletions, new PHP files in wp-content/uploads/, or modified theme files following Contributor account activity
WordPress Contributor accounts issuing AJAX requests that deviate from normal editorial patterns
PHP error log entries referencing unserialize() warnings or unexpected class instantiations tied to the plugin path inc/class-cx-rest.php

Detection Strategies

Inspect web server access logs for AJAX requests where the request body contains PHP serialization markers combined with the capture_email action
Monitor WordPress user activity for Contributor-tier accounts triggering AJAX actions associated with plugin backends
Alert on newly created PHP files, wp-config.php reads, or symlink creation in the WordPress document root shortly after suspicious AJAX traffic
Correlate PHP unserialize warnings from error_log with authenticated session identifiers to identify the originating account

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule that inspects POST bodies for serialized PHP objects targeting admin-ajax.php
Enable file integrity monitoring across the WordPress installation, focusing on wp-content/plugins/, wp-content/themes/, and root-level PHP files
Track privilege changes and content submissions from Contributor accounts through WordPress audit logging
Forward WordPress and PHP logs to a centralized platform for retention and correlation across the site

How to Mitigate CVE-2024-12627

Immediate Actions Required

Update the Coupon X plugin to a version later than 1.3.5 as soon as a patched release is available from the vendor
Audit all Contributor, Author, Editor, and Administrator accounts and remove any that are unnecessary or inactive
Rotate credentials for accounts that could have submitted content while the vulnerable version was installed
Review installed plugins and themes for known POP chain gadgets and remove unused extensions

Patch Information

The upstream code change is tracked in the WordPress plugin repository at changeset 3219466, which modifies inc/class-cx-rest.php. Site operators should upgrade to the fixed release referenced in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the Coupon X plugin until an updated version can be installed
Restrict Contributor role assignments and require multi-factor authentication for all authenticated WordPress accounts
Add a WAF rule to block requests to admin-ajax.php where the body contains PHP serialization patterns combined with the capture_email action
Disable unused plugins and themes to reduce the pool of classes available for POP chain construction

bash

# Example ModSecurity rule to block serialized payloads targeting the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1012627,phase:2,deny,status:403,msg:'CVE-2024-12627 PHP Object Injection attempt'"
    SecRule ARGS:action "@streq capture_email" \
        "chain"
        SecRule REQUEST_BODY "@rx (?:^|&|=)(?:O|a|s):\d+:" "t:none,t:urlDecodeUni"