CVE-2024-12721 Overview
CVE-2024-12721 is a PHP Object Injection vulnerability in the Custom Product Tabs For WooCommerce plugin for WordPress, developed by webbuilder143. The flaw affects all plugin versions up to and including 1.2.4. The vulnerability stems from deserialization of untrusted input supplied through the wb_custom_tabs parameter [CWE-502]. Authenticated attackers with Shop Manager-level access or higher can inject arbitrary PHP objects into the application. The vulnerable plugin itself contains no known Property-Oriented Programming (POP) chain. However, if a POP chain exists in another installed plugin or theme, an attacker can chain the injection to delete arbitrary files, retrieve sensitive data, or execute code on the underlying server.
Critical Impact
Authenticated Shop Manager users can trigger PHP Object Injection that may escalate to arbitrary file deletion, sensitive data exfiltration, or remote code execution when a POP chain is available in the environment.
Affected Products
- Custom Product Tabs For WooCommerce plugin for WordPress, all versions through 1.2.4
- WordPress sites running WooCommerce with the vulnerable plugin installed
- Sites where Shop Manager or higher accounts are accessible to attackers
Discovery Timeline
- 2024-12-21 - CVE-2024-12721 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12721
Vulnerability Analysis
The vulnerability resides in the plugin's handling of custom tab data submitted through the wb_custom_tabs request parameter. The plugin passes attacker-controlled input into a PHP deserialization routine without validating or filtering the serialized payload. Deserialization instantiates arbitrary PHP objects based on the class names encoded in the payload. When those classes define magic methods such as __destruct, __wakeup, or __toString, the resulting object graph can trigger unintended behavior during or after instantiation.
Exploitation requires authenticated access at the Shop Manager role or above, which limits the attacker population but does not eliminate risk. Compromised Shop Manager credentials, insider threats, and privilege escalation from lower-privileged roles all remain viable entry paths on WooCommerce stores.
Root Cause
The root cause is unsafe use of PHP unserialize() on untrusted input, classified as [CWE-502] Deserialization of Untrusted Data. The plugin source at class-wb-custom-product-tabs-for-woocommerce.php line 366 performs deserialization on the wb_custom_tabs parameter without a type-restricted allowlist or an integrity check on the serialized blob. See the WordPress Plugin Source Code for the vulnerable call site.
Attack Vector
The attack is delivered over the network through an authenticated HTTP request to a WordPress admin endpoint that saves custom product tab data. The attacker crafts a serialized PHP object payload and submits it in the wb_custom_tabs parameter. Because the vulnerable plugin has no internal POP chain, direct impact is limited to object instantiation. Real-world impact escalates when the WordPress site has other plugins or themes whose classes provide exploitable gadget chains, enabling arbitrary file deletion, data disclosure, or code execution. Technical details are documented in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2024-12721
Indicators of Compromise
- POST requests to WordPress admin endpoints containing a wb_custom_tabs parameter with values beginning with PHP serialization markers such as O:, a:, or s:
- Unexpected file deletions or file modifications in wp-content/ or WordPress core directories after Shop Manager activity
- Unusual outbound network connections initiated by the PHP worker process following product edits
- New or modified PHP files in upload or plugin directories that do not correspond to legitimate updates
Detection Strategies
- Inspect web server and WAF logs for requests to the plugin's save endpoints containing serialized PHP object patterns in wb_custom_tabs
- Monitor WordPress audit logs for product updates performed by Shop Manager accounts, correlating them with subsequent filesystem or process anomalies
- Compare installed plugin version against the fixed release and flag any host still running version 1.2.4 or earlier
Monitoring Recommendations
- Enable PHP error and exception logging to capture failed deserialization attempts and class-not-found errors that indicate probing
- Track file integrity for the wp-content/plugins, wp-content/themes, and wp-content/uploads directories
- Alert on any use of Shop Manager or Administrator accounts from unfamiliar IP addresses or geographies
How to Mitigate CVE-2024-12721
Immediate Actions Required
- Update the Custom Product Tabs For WooCommerce plugin to a version later than 1.2.4 as soon as the vendor publishes a fixed release
- Audit all Shop Manager and Administrator accounts, rotate credentials, and enforce multi-factor authentication
- Review installed plugins and themes for known POP chain gadgets and remove any that are unused
- Inspect the site for signs of exploitation, including unexpected file changes, new admin users, and unknown scheduled tasks
Patch Information
The vendor addressed the deserialization sink in the plugin repository. Review the WordPress Plugin Change Log for the specific changeset that removes or hardens the unsafe deserialization call. Administrators should install the latest available version from the WordPress plugin directory and verify the version string in wp-admin after upgrade.
Workarounds
- Deactivate and remove the Custom Product Tabs For WooCommerce plugin until an upgrade is applied
- Restrict access to /wp-admin/ using IP allowlists or a reverse proxy to limit exposure of the authenticated attack surface
- Deploy a Web Application Firewall (WAF) rule that blocks requests where wb_custom_tabs contains serialized PHP object signatures such as O: followed by an integer and a class name
- Downgrade Shop Manager accounts that do not require product tab editing rights, reducing the pool of accounts able to reach the vulnerable code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
