CVE-2024-2025

The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. CVE-2024-32603 is likely a duplicate of this issue.

• CWE-502

• https://plugins.trac.wordpress.org/changeset/3055634/wc4bp/trunk/class/includes/class-request-helper.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/78da9e79-399e-43e3-ac27-a162861cae71?source=cve
• https://plugins.trac.wordpress.org/changeset/3055634/wc4bp/trunk/class/includes/class-request-helper.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/78da9e79-399e-43e3-ac27-a162861cae71?source=cve

Published

Mar 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2019The WP-DB-Table-Editor plugin for WordPress is vulnerable to…7.5
• CVE-2024-2020The Calculated Fields Form plugin for WordPress is vulnerabl…6.1
• CVE-2024-2021A vulnerability was found in Netentsec NS-ASG Application Se…9.8
• CVE-2024-2022A vulnerability was found in Netentsec NS-ASG Application Se…9.8
• CVE-2024-2023The Folders and Folders Pro plugin for WordPress is vulnerab…4.3
• CVE-2024-2024The Folders Pro plugin for WordPress is vulnerable to arbitr…8.8
• CVE-2024-20251A vulnerability in the web-based management interface of Cis…5.4
• CVE-2024-20252Multiple vulnerabilities in Cisco Expressway Series and Cisc…8.8
• CVE-2024-20253A vulnerability in multiple Cisco Unified Communications and…10
• CVE-2024-20254Multiple vulnerabilities in Cisco Expressway Series and Cisc…8.8
• CVE-2024-20255A vulnerability in the SOAP API of Cisco Expressway Series a…7.1
• CVE-2024-20256A vulnerability in the web-based management interface of Cis…4.8