CVE-2024-8030: Ultimate Store Kit Elementor RCE Vulnerability

CVE-2024-8030 Overview

CVE-2024-8030 is a critical PHP Object Injection vulnerability affecting the Ultimate Store Kit Elementor Addons plugin for WordPress. This vulnerability exists in versions up to and including 2.0.3, where the plugin improperly deserializes untrusted input from the _ultimate_store_kit_wishlist cookie. The insecure deserialization allows unauthenticated attackers to inject arbitrary PHP objects into the application.

Critical Impact

Unauthenticated attackers can inject PHP objects that, when combined with a POP (Property Oriented Programming) chain present in other installed plugins or themes, could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution.

Affected Products

• bdthemes ultimate_store_kit (versions up to and including 2.0.3)
• WordPress installations using the Ultimate Store Kit Elementor Addons plugin
• WooCommerce and Easy Digital Downloads sites using this plugin for store building

Discovery Timeline

• 2024-08-28 - CVE CVE-2024-8030 published to NVD
• 2025-07-10 - Last updated in NVD database

Technical Details for CVE-2024-8030

Vulnerability Analysis

This PHP Object Injection vulnerability stems from insecure deserialization practices within the Ultimate Store Kit Elementor Addons plugin. The vulnerable code processes user-controlled data from the _ultimate_store_kit_wishlist cookie without proper sanitization or validation before passing it to PHP's deserialization functions. While the plugin itself does not contain a usable POP chain, the injected objects can interact with classes from other installed WordPress plugins or themes that do contain exploitable magic methods.

The vulnerability is particularly dangerous because it requires no authentication to exploit. An attacker simply needs to craft a malicious serialized PHP object and inject it via the wishlist cookie. The impact depends on what additional plugins or themes are installed on the target WordPress site, as these may provide the necessary POP chain to achieve code execution, file manipulation, or data exfiltration.

Root Cause

The root cause of CVE-2024-8030 is the use of PHP's unserialize() function on untrusted user input from the _ultimate_store_kit_wishlist cookie. The plugin fails to implement proper input validation or use safer alternatives such as json_decode() for handling user-provided data. This is classified as CWE-502 (Deserialization of Untrusted Data), a vulnerability class that has been responsible for numerous critical security incidents in PHP applications.

Attack Vector

The attack is network-based and can be executed remotely without any authentication or user interaction. An attacker crafts a malicious HTTP request containing a specially crafted serialized PHP object in the _ultimate_store_kit_wishlist cookie. When the WordPress application processes this cookie, the malicious object is deserialized, potentially triggering dangerous operations if a suitable POP chain exists in any installed plugin or theme.

The attack flow involves:

1. Attacker identifies a WordPress site running a vulnerable version of Ultimate Store Kit
2. Attacker enumerates other installed plugins/themes to identify available POP chains
3. Attacker crafts a serialized PHP object payload targeting the identified chain
4. Attacker sends a request with the malicious payload in the _ultimate_store_kit_wishlist cookie
5. Upon deserialization, the POP chain executes, achieving the attacker's objective

Detection Methods for CVE-2024-8030

Indicators of Compromise

• Unusual or malformed values in the _ultimate_store_kit_wishlist cookie containing serialized PHP object notation (e.g., strings starting with O: or a:)
• Web server logs showing requests with abnormally large or encoded cookie values for the wishlist functionality
• Unexpected file modifications, deletions, or new files appearing in the WordPress installation directory
• Database queries or file system access patterns inconsistent with normal plugin behavior

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in cookie values
• Monitor for suspicious cookie values containing PHP serialization indicators such as O:, a:, s:, and i: prefixes
• Deploy endpoint detection solutions to identify post-exploitation activities such as web shell creation or data exfiltration
• Review WordPress access logs for anomalous requests targeting pages that process the wishlist cookie

Monitoring Recommendations

• Enable detailed logging for all HTTP requests and monitor cookie content for serialized object patterns
• Implement file integrity monitoring (FIM) on critical WordPress directories to detect unauthorized modifications
• Set up alerts for unusual outbound network connections from the web server that could indicate data exfiltration
• Monitor system resource usage for anomalies that might indicate malicious code execution

How to Mitigate CVE-2024-8030

Immediate Actions Required

• Update the Ultimate Store Kit Elementor Addons plugin to version 2.0.4 or later immediately
• Audit your WordPress installation for other plugins or themes that may contain POP chains
• Review server logs for any indicators of exploitation attempts targeting the wishlist cookie
• Conduct a file integrity check to ensure no malicious files have been uploaded to the server

Patch Information

BDthemes has released a security patch addressing this vulnerability. The fix is available in the WordPress Plugin Change Log. Administrators should update to version 2.0.4 or later through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository. The patch modifies the helper.php file to properly sanitize cookie input before processing.

Additional technical details and analysis are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Ultimate Store Kit Elementor Addons plugin until the patch can be applied
• Implement server-side filtering to reject requests containing serialized PHP objects in cookies
• Configure your WAF to block requests with suspicious patterns in the _ultimate_store_kit_wishlist cookie
• Restrict access to the WordPress admin area and implement additional authentication measures while the vulnerability remains unpatched

# Example Apache mod_rewrite rule to block serialized PHP objects in cookies
# Add to .htaccess file
RewriteEngine On
RewriteCond %{HTTP_COOKIE} _ultimate_store_kit_wishlist.*O:[0-9]+: [NC,OR]
RewriteCond %{HTTP_COOKIE} _ultimate_store_kit_wishlist.*a:[0-9]+: [NC]
RewriteRule .* - [F,L]