CVE-2024-30230 Overview
CVE-2024-30230 is a PHP Object Injection vulnerability in the Acowebs PDF Invoices and Packing Slips For WooCommerce plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 1.3.7. An authenticated attacker with low privileges can inject a crafted serialized PHP object to trigger malicious property-oriented programming (POP) chains. Successful exploitation can compromise confidentiality, integrity, and availability of the WordPress site.
Critical Impact
Authenticated attackers can exploit PHP object injection to achieve remote code execution, data theft, or full site compromise when a suitable POP gadget chain is present.
Affected Products
- Acowebs PDF Invoices and Packing Slips For WooCommerce (WordPress plugin)
- Versions from n/a through 1.3.7
- Free edition distributed via the WordPress plugin repository
Discovery Timeline
- 2024-03-28 - CVE-2024-30230 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30230
Vulnerability Analysis
The plugin passes attacker-controlled input into a PHP deserialization function without validating the source or structure of the serialized data. When PHP reconstructs an object from this input, it invokes magic methods such as __wakeup() and __destruct() on classes that exist in the WordPress runtime. Attackers chain these methods through gadget classes to reach dangerous sinks. The result is arbitrary PHP object instantiation that can escalate into file writes, SQL execution, or remote code execution depending on gadget availability.
Root Cause
The root cause is the use of unserialize() on untrusted input supplied through plugin request handlers. The code does not enforce an allowlist of expected classes and does not use safer alternatives such as json_decode() or the allowed_classes option. This aligns with CWE-502, Deserialization of Untrusted Data.
Attack Vector
Exploitation requires network access to the WordPress site and a low-privilege authenticated account. The attacker submits a serialized PHP payload to a plugin endpoint that reaches the vulnerable deserialization sink. Because WordPress core and common plugins expose numerous gadget chains, the impact often escalates to arbitrary code execution in the web server context. Refer to the Patchstack Vulnerability Report for technical context.
Detection Methods for CVE-2024-30230
Indicators of Compromise
- Unexpected HTTP POST requests to plugin endpoints containing serialized PHP payload markers such as O:, a:, or s: in parameter values
- Creation of new administrative WordPress users or unexpected modifications to wp_options and wp_users tables
- New PHP files appearing under wp-content/uploads/ or the plugin directory following authenticated user activity
- Outbound connections from the web server to unfamiliar hosts shortly after plugin requests
Detection Strategies
- Inspect web server access logs for requests to PDF Invoices and Packing Slips For WooCommerce endpoints containing serialized object patterns
- Monitor PHP error logs for __wakeup, __destruct, or class-not-found warnings that indicate deserialization attempts
- Deploy a web application firewall rule that blocks request parameters matching PHP serialized object signatures
Monitoring Recommendations
- Enable file integrity monitoring on the wp-content/plugins/ and wp-content/uploads/ directories
- Alert on new administrator account creation and role changes in WordPress audit logs
- Correlate authenticated plugin requests with subsequent process execution or outbound network activity on the host
How to Mitigate CVE-2024-30230
Immediate Actions Required
- Update the Acowebs PDF Invoices and Packing Slips For WooCommerce plugin to a version later than 1.3.7 as soon as a fixed release is available
- Audit WordPress user accounts and revoke unnecessary low-privilege access that could be leveraged for exploitation
- Review recent plugin-related requests and file changes for signs of prior exploitation
Patch Information
The vendor advisory is tracked through the Patchstack Vulnerability Report. Administrators should apply the vendor-supplied update that addresses the deserialization sink and verify the installed plugin version after upgrade.
Workarounds
- Disable and remove the plugin until a patched version is installed
- Restrict access to WordPress authentication endpoints using IP allowlists or multi-factor authentication
- Deploy a WAF rule to block serialized PHP object patterns in request bodies and query strings targeting plugin routes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
