CVE-2024-12313

The vulnerability in the Compare Products for WooCommerce plugin for WordPress arises from improper handling of user input, specifically through the deserialization of untrusted data from the 'woo_compare_list' cookie. This flaw allows an attacker to inject a PHP object into the application, potentially leading to various forms of exploitation. The core issue lies in the fact that the plugin does not adequately validate or sanitize the input it receives, which is a common oversight in many web applications. When an attacker crafts a malicious cookie and sends it to the server, the application may unwittingly process this data, resulting in the execution of unintended PHP code.

Exploitation of this vulnerability can occur through several attack vectors. An unauthenticated attacker can leverage the deserialization flaw by manipulating the 'woo_compare_list' cookie to include a crafted payload. While the vulnerable software itself does not provide a direct path to a "proof of concept" (POP) chain, the presence of additional plugins or themes that may have their own vulnerabilities can create a chain reaction. For instance, if an attacker successfully injects a PHP object that interacts with another vulnerable component, they could escalate their access to perform actions such as deleting arbitrary files, retrieving sensitive information, or executing arbitrary code on the server. This flexibility in exploitation makes the vulnerability particularly concerning, as it can be tailored to the specific environment of the target.

The real-world impact of this vulnerability can be significant, especially for e-commerce businesses relying on the WooCommerce platform. A successful attack could lead to data breaches, loss of customer trust, and potential financial losses. The ability to delete files or execute code could disrupt business operations, leading to downtime and recovery costs. Furthermore, if sensitive customer data is accessed or exfiltrated, the business could face legal repercussions, regulatory fines, and damage to its reputation. The combination of these factors underscores the importance of addressing such vulnerabilities promptly to mitigate business risk.

To detect and mitigate this vulnerability, organizations should adopt a multi-faceted approach. First, regular security audits and code reviews of plugins and themes should be conducted to identify and remediate vulnerabilities. Implementing web application firewalls (WAF) can help filter out malicious requests before they reach the application layer. Additionally, organizations should ensure that all components of their WordPress installation, including the core, plugins, and themes, are kept up to date with the latest security patches. Educating developers on secure coding practices, particularly regarding input validation and sanitization, is also crucial in preventing similar vulnerabilities from being introduced in the future.

In conclusion, the vulnerability present in the Compare Products for WooCommerce plugin represents a serious threat to WordPress-based e-commerce sites. The potential for exploitation through PHP object injection highlights the need for robust security measures and proactive risk management strategies. By understanding the technical details, attack vectors, and real-world implications of such vulnerabilities, organizations can better prepare themselves to defend against potential threats and safeguard their digital assets.

Recent updates to the CVSS and EPSS scores for CVE-2024-12313 indicate a marked reassessment of the vulnerability’s exploitability and potential impact. CSURFACE threat intelligence has identified a significant upward revision in the CVSS base score from zero to 8.1, reflecting a recognition of the vulnerability’s high severity due to unauthenticated PHP object injection risks via the ‘woo_compare_list’ cookie. Concurrently, the EPSS score has doubled, accompanied by a rapid and sustained upward trend in exploit probability as indicated by our telemetry. This shift suggests growing confidence within the threat landscape that exploitation is feasible, particularly if an attacker can leverage additional plugins or themes to establish a POP chain. Although no new proof-of-concept exploits or active exploitation campaigns have been detected, the increasing EPSS score signals a rising likelihood of future exploitation attempts. For defenders, this evolution underscores an elevated threat level and necessitates heightened vigilance in monitoring affected environments. The updated risk profile reflects a transition from a theoretical vulnerability to one with tangible exploitation potential, thereby increasing the urgency for risk management and detection capabilities focused on this plugin’s attack surface.

Update 2 — June 13, 2026

CSURFACE threat intelligence has observed a measurable increase in the Exploit Prediction Scoring System (EPSS) for CVE-2024-12313, reflecting a growing probability of exploitation despite the absence of new proof-of-concept exploits or active attack campaigns. This upward adjustment in EPSS, now approaching the 93rd percentile, indicates that threat actors may be intensifying reconnaissance or preparatory activities targeting the Compare Products for WooCommerce plugin. The heightened score suggests that exploitation attempts could become more frequent or sophisticated, particularly in environments where additional plugins or themes enable a viable PHP Object Injection POP chain. For defenders, this shift elevates the urgency to monitor for anomalous deserialization behaviors and cookie manipulation indicative of exploitation attempts. The risk profile has thus transitioned from a primarily theoretical concern to a more imminent threat, warranting increased attention to detection and response capabilities focused on this vulnerability’s attack vector.