CVE-2024-4371

The vulnerability present in the CoDesigner WooCommerce Builder for Elementor plugin for WordPress stems from a critical flaw in the handling of untrusted input, specifically through the deserialization of data from the recently_viewed_products cookie. This type of vulnerability is categorized as PHP Object Injection, which allows an attacker to manipulate the object structure within the PHP environment. In this case, the plugin fails to adequately validate and sanitize the data being deserialized, leading to the potential for an attacker to inject malicious PHP objects into the application. The absence of a known "proof of concept" (POP) chain within the plugin itself does not mitigate the risk, as the presence of other plugins or themes could facilitate the exploitation of this vulnerability.

Attack vectors for exploiting this vulnerability are particularly concerning due to the unauthenticated nature of the attack. An attacker could craft a malicious request that includes a specially formatted cookie, thereby triggering the deserialization process within the vulnerable plugin. Once the malicious object is injected, the attacker could leverage the capabilities of the PHP environment to execute arbitrary code, delete files, or extract sensitive information, depending on the permissions and configurations of the WordPress instance. The potential for exploitation is exacerbated by the fact that many WordPress installations may have additional plugins or themes that could provide a pathway for a successful attack, thereby increasing the severity of the threat.

The real-world impact of this vulnerability is significant, particularly for e-commerce platforms relying on the CoDesigner plugin. An attacker gaining access to sensitive customer data, such as payment information or personal details, could lead to severe reputational damage and financial loss for businesses. Additionally, the ability to execute arbitrary code could allow attackers to deploy malware, create backdoors, or even take control of the entire server, leading to a complete compromise of the affected environment. The high CVSS score of 9.8 indicates that this vulnerability poses a critical risk, necessitating immediate attention from organizations utilizing the affected plugin.

Detection and mitigation strategies for this vulnerability should focus on both proactive and reactive measures. Organizations should conduct regular security audits and vulnerability assessments to identify any instances of the CoDesigner plugin in use and ensure that it is updated to the latest version, which addresses this flaw. Implementing a Web Application Firewall (WAF) can help filter out malicious requests and provide an additional layer of security against exploitation attempts. Furthermore, organizations should consider employing input validation and sanitization practices for all user inputs, especially those that involve deserialization, to prevent similar vulnerabilities from being introduced in the future.

In conclusion, the PHP Object Injection vulnerability in the CoDesigner WooCommerce Builder for Elementor plugin represents a serious threat to WordPress installations, particularly those operating in e-commerce environments. The potential for exploitation by unauthenticated attackers, combined with the severe consequences of a successful attack, underscores the importance of immediate action to mitigate risks. By adopting comprehensive security measures, organizations can protect themselves from this and similar vulnerabilities, ensuring the integrity and security of their web applications.

The CVSS score adjustment from 9.8 to 9.0 for CVE-2024-4371 reflects a refined understanding of the vulnerability’s exploitability and impact, as assessed by CSURFACE threat intelligence. This recalibration indicates a slightly reduced but still critical risk level, emphasizing that while the vulnerability remains highly severe, the likelihood or ease of exploitation may be somewhat lower than initially estimated. Our telemetry continues to show stable exploitation potential without any emergent proof-of-concept exploits or a marked increase in attack attempts targeting the recently_viewed_products cookie deserialization flaw. The EPSS score remains elevated and in the 0.90th percentile, signaling persistent interest and risk within the threat landscape. For defenders, this nuanced downgrade underscores the importance of maintaining vigilance but suggests that immediate widespread exploitation has not materialized. Consequently, the threat level remains critical, warranting ongoing monitoring and prioritization in vulnerability management programs, especially given the plugin’s prevalence in e-commerce WordPress environments.

Update 2 — May 21, 2026

CSURFACE threat intelligence has updated the CVSS severity rating for CVE-2024-4371 from 9.0 to 9.8, reflecting a reassessment of the vulnerability’s criticality based on evolving contextual factors. This adjustment underscores a heightened recognition of the potential impact and exploitability of the PHP Object Injection flaw within the CoDesigner WooCommerce Builder plugin, particularly given its ability to be triggered via unauthenticated input through the recently_viewed_products cookie. While no new proof-of-concept exploits or active exploitation campaigns have been detected by our telemetry, the increased CVSS score signals that the vulnerability’s risk profile is more severe than previously assessed. For defenders, this change emphasizes the urgency of addressing this issue within affected WordPress environments, as the elevated score aligns with a scenario where successful exploitation could lead to significant compromise, especially if combined with additional plugins or themes that provide a gadget chain. The stable EPSS score in the 0.90th percentile continues to indicate sustained attacker interest, reinforcing the critical nature of this vulnerability despite the absence of a marked surge in exploitation attempts. Overall, the threat level remains critical, with the updated CVSS score serving as a stronger indicator of potential impact and the need for continued vigilance in vulnerability management.