CVE-2024-11465: 
WordPress vulnerability analysis and mitigation

The Custom Product Tabs for WooCommerce WordPress plugin (versions up to 1.8.5) contains a PHP Object Injection vulnerability identified as CVE-2024-11465. The vulnerability was discovered in January 2025 and affects the plugin through the 'yikes_woo_products_tabs' post meta parameter, which improperly handles deserialization of untrusted input (NVD).

The vulnerability stems from unsafe deserialization of untrusted input in the 'yikes_woo_products_tabs' post meta parameter. It has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) (NVD).

While no known POP (Property-Oriented Programming) chain exists in the vulnerable software itself, if a POP chain is present through additional plugins or themes installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code on the affected system (NVD).

The vulnerability can only be exploited by authenticated users with Shop Manager-level access and above. While this requirement limits the potential attack surface, it still presents a significant risk for WordPress installations using the affected plugin versions (NVD).

Users should update their Custom Product Tabs for WooCommerce plugin to a version newer than 1.8.5 to address this vulnerability. No alternative workarounds have been publicly documented (NVD).