CVE-2024-12600

The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frs_woo_product_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502

• https://plugins.trac.wordpress.org/browser/woocommerce-custom-product-tabs-lite/trunk/woocommerce-custom-product-tabs-lite.php#L372
• https://plugins.trac.wordpress.org/changeset/3226839/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/33c16b47-3202-4f26-bf45-98172b8cac45?source=cve

Published

Jan 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12595The AHAthat Plugin WordPress plugin through 1.6 does not esc…4.7
• CVE-2024-12596The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…4.3
• CVE-2024-12597The HT Mega – Absolute Addons For Elementor plugin for WordP…5.4
• CVE-2024-12598The MyBookProgress by Stormhill Media plugin for WordPress i…6.4
• CVE-2024-12599The HT Mega – Absolute Addons For Elementor plugin for WordP…6.4
• CVE-2024-1260A vulnerability classified as critical has been found in Jua…9.8
• CVE-2024-12601The Calculated Fields Form plugin for WordPress is vulnerabl…5.3
• CVE-2024-12602Identity verification vulnerability in the ParamWatcher modu…7.5
• CVE-2024-12603A logic vulnerability in the the mobile application (com.tra…9.8
• CVE-2024-12604Cleartext Storage of Sensitive Information in an Environment…6.5
• CVE-2024-12605The AI Scribe – SEO AI Writer, Content Generator, Humanizer,…4.3
• CVE-2024-12606The AI Scribe – SEO AI Writer, Content Generator, Humanizer,…4.3