CVE-2024-43128: WooCommerce Product Table RCE Vulnerability

CVE-2024-43128 Overview

CVE-2024-43128 is a code injection vulnerability in the WooCommerce Product Table Lite plugin for WordPress, developed by WC Product Table. The flaw affects all plugin versions from initial release through 3.5.1. Attackers can exploit the issue remotely over the network without authentication or user interaction. The weakness is classified under [CWE-94] Improper Control of Generation of Code.

WordPress sites running the affected plugin expose product table rendering functionality that mishandles attacker-controlled input. Successful exploitation results in arbitrary code execution within the WordPress runtime context.

Critical Impact
Unauthenticated attackers can inject and execute arbitrary code on WordPress sites running WooCommerce Product Table Lite through version 3.5.1, compromising site integrity, confidentiality, and availability.

Affected Products

WooCommerce Product Table Lite plugin for WordPress, all versions up to and including 3.5.1
WordPress sites using the wcproducttable/woocommerce_product_table component
WooCommerce-based storefronts that render product tables via the Lite edition

Discovery Timeline

2024-08-13 - CVE-2024-43128 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43128

Vulnerability Analysis

The vulnerability stems from improper control of code generation within the WooCommerce Product Table Lite plugin. The plugin processes input that flows into a code evaluation or template construction path without adequate sanitization. Attackers craft payloads that the plugin interprets as executable code rather than data.

Because the issue is reachable over the network and requires no authentication or user interaction, exploitation does not depend on social engineering or prior access. The EPSS probability sits at 0.282%, reflecting limited observed exploitation attempts to date. No public proof-of-concept is currently listed in ExploitDB, and CISA has not added the entry to the Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is classified as [CWE-94] Improper Control of Generation of Code. The plugin constructs or evaluates code using input that an attacker can influence. Without strict allow-list validation or safe templating, the input crosses the boundary between data and executable instructions. The Patchstack advisory describes the result as arbitrary code execution against the WordPress process.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to the vulnerable WordPress endpoint exposed by the plugin. The payload reaches the code generation routine inside the plugin and executes within the PHP runtime hosting WordPress. Outcomes include arbitrary PHP execution, configuration disclosure, modification of site content, and pivoting to other services reachable from the web server.

Verified exploitation code is not publicly available. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-43128

Indicators of Compromise

Unexpected PHP files written under wp-content/plugins/, wp-content/uploads/, or theme directories after requests targeting the plugin
Outbound connections from the web server to unknown hosts following requests to WooCommerce Product Table endpoints
New or modified WordPress administrator accounts with no corresponding audit entry
Web server logs containing requests with PHP function names or serialized payloads in parameters handled by the plugin

Detection Strategies

Inventory WordPress sites for the woocommerce-product-table plugin and flag installations at version 3.5.1 or earlier
Inspect access logs for anomalous POST or GET parameters targeting plugin shortcode handlers and AJAX endpoints
Monitor PHP error logs for parse errors or runtime exceptions originating from plugin files, which often accompany failed injection attempts

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a central analytics platform for correlation
Alert on creation of executable files within web roots and on changes to WordPress core or plugin files outside maintenance windows
Track child processes spawned by the PHP-FPM or web server user, since arbitrary code execution often leads to shell or network utility invocations

How to Mitigate CVE-2024-43128

Immediate Actions Required

Update WooCommerce Product Table Lite to a fixed release above version 3.5.1 once published by the vendor
Deactivate and remove the plugin on sites where a patched version is not yet available
Review WordPress administrator accounts, scheduled tasks, and recently modified files for signs of compromise
Rotate WordPress secrets in wp-config.php, database credentials, and API tokens stored on affected hosts

Patch Information

The vendor advisory from Patchstack identifies all versions through 3.5.1 as vulnerable. Administrators should consult the Patchstack Vulnerability Advisory and the official plugin listing for the current fixed release before upgrading production environments.

Workarounds

Restrict access to WordPress administrative and AJAX endpoints using a web application firewall with virtual patching rules
Disable the plugin until a patched version is installed and verified in staging
Apply least privilege to the PHP runtime user and prevent write access to plugin and core directories where business requirements allow

bash

# Identify affected installations and disable the plugin via WP-CLI
wp plugin list --name=woocommerce-product-table --fields=name,status,version
wp plugin deactivate woocommerce-product-table
wp plugin delete woocommerce-product-table