CVE-2024-8922 Overview
CVE-2024-8922 is a PHP Object Injection vulnerability in the Product Enquiry for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.2.33.32. It stems from deserialization of untrusted input in enquiry_detail.php. Authenticated attackers with Author-level access or higher can inject arbitrary PHP objects into the application. The vulnerable software does not ship with a known Property-Oriented Programming (POP) chain. However, if a POP chain exists in another installed plugin or theme, attackers can chain the injection to delete arbitrary files, exfiltrate sensitive data, or execute arbitrary code on the host.
Critical Impact
Authenticated attackers with Author-level privileges can inject PHP objects that, when combined with a POP chain from another plugin or theme, lead to arbitrary file deletion, sensitive data disclosure, or remote code execution on the WordPress host.
Affected Products
- Piwebsolution Product Enquiry for WooCommerce plugin (WordPress)
- All versions up to and including 2.2.33.32
- WordPress sites running WooCommerce with the vulnerable plugin installed
Discovery Timeline
- 2024-09-27 - CVE-2024-8922 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8922
Vulnerability Analysis
The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data]. The Product Enquiry for WooCommerce plugin passes attacker-controlled input to a PHP deserialization routine inside enquiry_detail.php. When PHP's unserialize() function processes attacker-supplied serialized data, it instantiates PHP objects and triggers their magic methods such as __wakeup() and __destruct(). Attackers can craft serialized payloads that reference classes defined in other loaded plugins or themes. If any such class contains sensitive operations inside its magic methods, the attacker constructs a POP chain that reaches those sinks. Common outcomes include arbitrary file deletion through unlink() sinks, arbitrary file writes, information disclosure, and full remote code execution.
Root Cause
The root cause is the direct passing of untrusted, user-controlled input into PHP's deserialization mechanism without validation, integrity checks, or a safe format such as JSON. The plugin trusts serialized data supplied by authenticated users and reconstructs PHP objects from it. This design pattern violates safe input handling and exposes any reachable class hierarchy to attacker abuse.
Attack Vector
Exploitation requires an authenticated account with Author-level access or higher on the target WordPress site. The attacker submits a crafted serialized PHP payload through the enquiry functionality handled by enquiry_detail.php. The payload triggers deserialization on the server. Standalone exploitation only yields object injection, but combining the payload with a POP chain from any other installed plugin or theme escalates impact to file deletion, data theft, or code execution. The attack is network-reachable and requires no user interaction.
See the Wordfence Vulnerability Analysis for technical details.
Detection Methods for CVE-2024-8922
Indicators of Compromise
- POST requests to WordPress endpoints handling product enquiries that contain serialized PHP payloads beginning with markers such as O:, a:, or s:.
- Unexpected file deletions, file creations, or PHP webshells appearing in the WordPress wp-content directory following enquiry submissions.
- New or modified Author-level user accounts submitting enquiry requests with abnormally large or binary payloads.
Detection Strategies
- Inspect web server and application logs for enquiry submissions containing serialized object markers or references to class names from installed plugins and themes.
- Deploy a Web Application Firewall (WAF) rule that flags serialized PHP data patterns submitted to the plugin's enquiry endpoints.
- Audit installed plugin versions across WordPress sites and alert on any instance of Product Enquiry for WooCommerce at version 2.2.33.32 or earlier.
Monitoring Recommendations
- Monitor file integrity across wp-content/plugins, wp-content/themes, and wp-content/uploads for unauthorized changes.
- Track authentication events for Author-level and higher accounts, especially those created recently or exhibiting unusual posting behavior.
- Alert on PHP process spawning shell utilities or writing executable files from the web server user context.
How to Mitigate CVE-2024-8922
Immediate Actions Required
- Update the Product Enquiry for WooCommerce plugin to a version later than 2.2.33.32 as published in the WordPress Changeset Update.
- Review all Author-level and higher accounts, remove unused accounts, and reset credentials for accounts that cannot be verified.
- Audit installed plugins and themes for known POP chain gadgets and remove any unused components.
Patch Information
The vendor addressed the vulnerability in the plugin release corresponding to WordPress plugin changeset 3155863. Site administrators should apply the update through the WordPress plugin dashboard or by installing the fixed release directly from the plugin repository changeset.
Workarounds
- Restrict the ability to submit product enquiries to trusted user roles by adjusting role capabilities until patching is complete.
- Deploy WAF rules that block requests containing serialized PHP payloads targeting the enquiry endpoints.
- Temporarily disable the Product Enquiry for WooCommerce plugin on sites that cannot be updated immediately.
# Configuration example: WP-CLI commands to identify and update the vulnerable plugin
wp plugin list --name=enquiry-quotation-for-woocommerce --fields=name,status,version
wp plugin update enquiry-quotation-for-woocommerce
wp plugin deactivate enquiry-quotation-for-woocommerce # temporary workaround if patch cannot be applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
