CVE-2024-1773: PDF Invoices WooCommerce RCE Vulnerability

CVE-2024-1773 is a PHP object injection flaw in Acowebs PDF Invoices and Packing Slips for WooCommerce that enables authenticated attackers to potentially execute code, delete files, or access sensitive data. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2024-1773 Overview

CVE-2024-1773 is a PHP Object Injection vulnerability in the PDF Invoices and Packing Slips For WooCommerce plugin for WordPress. All versions up to and including 1.3.7 deserialize untrusted input passed through the order_id parameter. Authenticated attackers with subscriber-level access or higher can inject arbitrary PHP objects into the application.

The vulnerable plugin itself does not ship a Property-Oriented Programming (POP) chain. However, if a suitable gadget chain exists in another installed plugin or theme, the injection can lead to arbitrary file deletion, sensitive data disclosure, or remote code execution.

Critical Impact
Authenticated attackers with low-privilege accounts can inject PHP objects that, when combined with a POP chain from another component, may achieve remote code execution on the WordPress host.

Affected Products

Acowebs PDF Invoices and Packing Slips For WooCommerce plugin, versions up to and including 1.3.7
WordPress sites running WooCommerce with this plugin installed
Deployments allowing subscriber-level or higher user registration

Discovery Timeline

2024-03-07 - CVE-2024-1773 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1773

Vulnerability Analysis

The flaw resides in the plugin's front-end handler located in includes/class-apifw-front-end.php. The order_id parameter is passed to PHP's unserialize() function without validation or sanitization. Passing attacker-controlled data to unserialize() allows instantiation of arbitrary PHP objects within the application context.

This is a classic insecure deserialization pattern classified under CWE-502 and CWE-74. When the injected object is destroyed or interacted with, magic methods such as __wakeup(), __destruct(), or __toString() execute using attacker-controlled property values.

The plugin alone does not expose a usable gadget chain. Exploitation requires that another plugin, theme, or library present in the WordPress installation contains classes whose magic methods perform dangerous operations. WordPress environments frequently satisfy this precondition given the large surface of third-party code.

Root Cause

The plugin invokes unserialize() on the value received from the order_id request parameter instead of treating the value as an integer identifier. No type coercion, allow-list, or safe alternative such as json_decode() is applied before deserialization.

Attack Vector

Exploitation is network-based and requires authentication at subscriber level or above. The attacker submits a crafted serialized PHP payload in the order_id parameter to the vulnerable endpoint. The plugin deserializes the payload and instantiates the encoded object graph. When combined with a POP chain from another installed component, the attacker gains file deletion, data exfiltration, or code execution capability. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Section for technical details.

Detection Methods for CVE-2024-1773

Indicators of Compromise

HTTP requests containing serialized PHP payload markers such as O:, a:, or s: in the order_id parameter value
Unexpected file deletions, PHP errors, or __wakeup/__destruct invocations correlated with plugin endpoints
Subscriber-level accounts issuing requests to WooCommerce PDF invoice endpoints outside normal user workflows

Detection Strategies

Inspect web server and WordPress access logs for order_id parameter values that are not simple integers
Monitor PHP error logs for deserialization warnings, class-not-found errors, or unexpected magic method invocations
Alert on newly created or elevated low-privilege WordPress accounts followed by requests to plugin endpoints

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule that flags serialized PHP object patterns in query and body parameters
Baseline normal order_id request patterns and alert on deviations in length, character class, or encoding
Track plugin and theme inventory changes so that newly introduced components can be reviewed for POP-chain gadgets

How to Mitigate CVE-2024-1773

Immediate Actions Required

Update the PDF Invoices and Packing Slips For WooCommerce plugin to a version above 1.3.7
Audit WordPress user accounts and remove unnecessary subscriber-level registrations
Review installed plugins and themes for known deserialization gadget chains and remove unused components

Patch Information

The vendor addressed the vulnerability in the plugin trunk. Review the fix in the WordPress Changeset #3042740. Site operators should upgrade to the patched release available through the WordPress plugin repository.

Workarounds

Disable open user registration or restrict registration to trusted email domains until patched
Deploy WAF rules that block serialized PHP object patterns in the order_id parameter
Temporarily deactivate the plugin if an immediate update is not feasible

bash

# Example WAF rule pattern to block serialized PHP objects in order_id
# ModSecurity rule (illustrative)
SecRule ARGS:order_id "@rx ^[Oa]:[0-9]+:" \
    "id:1002024,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential PHP Object Injection in order_id (CVE-2024-1773)'"